CVE-2019-14378

Advisory lineage Upstream: 0 Downstream: 40
Modified
Published: 29 Jul 2019, 10:05
Last modified:05 Aug 2024, 00:19

Vulnerability Summary

Overall Risk (default)
medium
46/100
CVSS Score
8.8 HIGH
v3.0 (nvd)
EPSS Score
6.47% LOW
6% probability -2.60%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

29 Jul 2019, 10:05
Published
Vulnerability first disclosed
05 Aug 2024, 00:19
Last Modified
Vulnerability information updated

Description

ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.

CVSS Metrics

  • v3.0•HIGH•Score: 8.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 6.5AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 6.47%• Percentile: 91%

Techniques & Countermeasures

  • CWE-755•Improper Handling of Exceptional Conditions

    The product does not handle or incorrectly handles an exceptional condition.

  • CWE-787•Out-of-bounds Write

    The product writes data past the end, or before the beginning, of the intended buffer.

Affected Systems

  • libslirp_project•libslirp

    4.0.0

References (27)