CVE-2019-3459: canonical ubuntu_linux Out-of-bounds Read
Vulnerability summary
CVE-2019-3459 is a medium (CVSS 6.5) Out-of-bounds Read vulnerability in canonical ubuntu_linux. EPSS estimates a 1.83% chance of exploitation in the next 30 days, higher than 78.8% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.5, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 24 · Related 17Timeline
- 11-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.83%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.83% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (marc.info)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu25 products
- linux< 3.13.0-168.218 | < 4.4.0-145.171 | < 4.15.0-47.50
- linux-aws< 4.4.0-1040.43 | < 4.4.0-1079.89 | < 4.15.0-1035.37
- linux-aws-hwe< 4.15.0-1035.37~16.04.1
- linux-azure< 4.15.0-1041.45~14.04.1 | < 4.15.0-1041.45 | < 4.18.0-1014.14~18.04.1
- linux-azure-6.11All versions (No fix recorded)
Redhat13 products
- codeready_linux_builder8.0
- enterprise_linuxEOL5.0 | 6.0 | 7.0 | 8.0
- enterprise_linux_desktop7.0
- enterprise_linux_eus8.1 | 8.2 | 8.4
- enterprise_linux_for_real_time7 | 8
Debian2 products
- linux< 4.19.37-1
- debian_linuxEOL8.0
Linux2 products
- linux< 5.1-rc1 | fixed in 5.1-rc1
- linux_kernel≤ 5.1
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
5 vendors · 43 products
References
31 links- marc.info?l=oss-security&m=154721580222522&w=2Mailing ListX Refsource MLISTExploitThird Party Advisory
- git.kernel.org/linus/7c9cbd0b5e38a1672fcd137894ace3b042dfbf69X Refsource CONFIRMREPORTPatchVendor Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1663176X Refsource CONFIRMIssue TrackingMitigationThird Party Advisory
- people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-3459.htmlX Refsource CONFIRMThird Party Advisory
- bugzilla.novell.com/show_bug.cgi?id=1120758X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2019/05/msg00002.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.debian.org/debian-lts-announce/2019/05/msg00041.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.debian.org/debian-lts-announce/2019/05/msg00042.htmlMailing ListX Refsource MLISTThird Party Advisory