CVE catalog

CVE-2019-11579

dhcpcd5: CVE-2019-11579

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.41% · Oct 25, 2026

dhcp.c in dhcpcd before 7.2.1 contains a 1-byte read overflow with DHO_OPTSOVERLOADED.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandhcpcd5bookworm9.4.1-24~deb12u5fixed
Ubuntudhcpcd5pro5.5.6-1vulnerable
Ubuntudhcpcd5pro6.0.5-1ubuntu1vulnerable
Ubuntudhcpcd5pro6.0.5-1.1vulnerable
Ubuntudhcpcd5pro6.0.5-2build0.14.04.1vulnerable
Ubuntudhcpcd5pro6.0.5-2+deb8u1build0.14.04.1~esm1fixed
Ubuntudhcpcd516.046.9.1-1vulnerable
Ubuntudhcpcd516.046.9.3-1vulnerable
Ubuntudhcpcd516.046.10.1-1vulnerable
Ubuntudhcpcd518.046.11.5-0ubuntu1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandhcpcd5sourcebookworm7.1.0-2lowNot reported[928104]
Ubuntudhcpcd5debpro6.0.5-2+deb8u1build0.14.04.1~esm1Not reportedUBUNTU-CVE-2019-11579Not reported

[Debian bug #928104]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [dhcpcd5]Fixed

    Source package: [dhcpcd]

    Details (4)

    • 9.4.1-24~deb12u5 · all · bookworm

      Fixed · Fixed: 7.1.0-2

      dsa · dhcpcd5 · debian · bookworm; dsa · dhcpcd5 · debian · 12

    • 9.4.1-24~deb12u5 · all · bookworm

      Fixed · Fixed: 7.1.0-2

      dsa · dhcpcd5 · debian · bookworm; dsa · dhcpcd5 · debian · 12

    • 1:10.1.0-11~bpo12+3 · all · bookworm-backports

      Fixed · Fixed: 7.1.0-2

      dsa · dhcpcd5 · debian · bookworm; dsa · dhcpcd5 · debian · 12

    • 1:10.1.0-11~bpo12+3 · all · bookworm-backports

      Fixed · Fixed: 7.1.0-2

      dsa · dhcpcd5 · debian · bookworm; dsa · dhcpcd5 · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]