CVE catalog

CVE-2019-5482

curl: CVE-2019-5482

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Published
Source
[NVD] · [CVE record]
EPSS
17.94% · Oct 25, 2026

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancurlsid8.23.0-1fixed
Debiancurlforky8.22.0-1fixed
Debiancurltrixie8.14.1-2+deb13u5fixed
Debiancurltrixie-security8.14.1-2+deb13u7fixed
Debiancurlbookworm7.88.1-10+deb12u15fixed
Debiancurlbookworm-security7.88.1-10+deb12u5fixed
CpecurlNot reportedNot reportedunknown
CpefedoraNot reportedNot reportedunknown
CpeleapNot reportedNot reportedunknown
Cpecloud_backupNot reportedNot reportedunknown
Cpeoncommand_insightNot reportedNot reportedunknown
Cpeoncommand_unified_managerNot reportedNot reportedunknown
Cpeoncommand_workflow_automationNot reportedNot reportedunknown
CpesnapcenterNot reportedNot reportedunknown
Cpesteelstore_cloud_integrated_storageNot reportedNot reportedunknown
Cpecommunications_operations_monitorNot reportedNot reportedunknown
Cpecommunications_session_border_controllerNot reportedNot reportedunknown
Alpinecurl3.107.66.0-r0fixed
Alpinecurl3.117.66.0-r0fixed
Alpinecurl3.127.66.0-r0fixed
Alpinecurl3.137.66.0-r0fixed
Alpinecurl3.147.66.0-r0fixed
Alpinecurl3.157.66.0-r0fixed
Alpinecurl3.167.66.0-r0fixed
Alpinecurl3.177.66.0-r0fixed
Alpinecurl3.187.66.0-r0fixed
Alpinecurl3.197.66.0-r0fixed
Alpinecurl3.207.66.0-r0fixed
Alpinecurl3.217.66.0-r0fixed
Alpinecurl3.227.66.0-r0fixed
Alpinecurl3.237.66.0-r0fixed
Alpinecurl3.247.66.0-r0fixed
Alpinecurl3.77.61.1-r3fixed
Alpinecurl3.87.61.1-r3fixed
Alpinecurl3.97.64.0-r3fixed
Ubuntucurlpro7.32.0-1ubuntu1vulnerable
Ubuntucurlpro7.33.0-1ubuntu1vulnerable
Ubuntucurlpro7.34.0-1ubuntu1vulnerable
Ubuntucurlpro7.35.0-1ubuntu1vulnerable
Ubuntucurlpro7.35.0-1ubuntu2vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.1vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.2vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.3vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.5vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.6vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.7vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.8vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.9vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.10vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.11vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.12vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.13vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.14vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.15vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.16vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.17vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.19vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20+esm2vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20+esm3fixed
Ubuntucurlpro7.32.0-1ubuntu1vulnerable
Ubuntucurlpro7.33.0-1ubuntu1vulnerable
Ubuntucurlpro7.34.0-1ubuntu1vulnerable
Ubuntucurlpro7.35.0-1ubuntu1vulnerable
Ubuntucurlpro7.35.0-1ubuntu2vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.1vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.2vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.3vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.5vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.6vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.7vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.8vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.9vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.10vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.11vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.12vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.13vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.14vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.15vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.16vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.17vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.19vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20+esm2vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20+esm3fixed
Ubuntucurl16.047.43.0-1ubuntu2vulnerable
Ubuntucurl16.047.45.0-1ubuntu1vulnerable
Ubuntucurl16.047.46.0-1ubuntu1vulnerable
Ubuntucurl16.047.47.0-1ubuntu1vulnerable
Ubuntucurl16.047.47.0-1ubuntu2vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.1vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.2vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.3vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.4vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.5vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.6vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.7vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.8vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.9vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.11vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.12vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.13vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.14fixed
Ubuntucurl18.047.55.1-1ubuntu2vulnerable
Ubuntucurl18.047.55.1-1ubuntu2.1vulnerable
Ubuntucurl18.047.57.0-1ubuntu1vulnerable
Ubuntucurl18.047.58.0-2ubuntu1vulnerable
Ubuntucurl18.047.58.0-2ubuntu2vulnerable
Ubuntucurl18.047.58.0-2ubuntu3vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.1vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.2vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.3vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.5vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.6vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.7vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.8fixed
Susecurlhpe helion openstack 87.37.0-37.43.1fixed
Susecurlopenstack cloud 77.37.0-37.43.1fixed
Susecurlopenstack cloud 87.37.0-37.43.1fixed
Susecurlopenstack cloud crowbar 87.37.0-37.43.1fixed
Susecurllinux enterprise server for sap applications 12 sp17.37.0-37.43.1fixed
Susecurllinux enterprise server for sap applications 12 sp27.37.0-37.43.1fixed
Susecurllinux enterprise server for sap applications 12 sp37.37.0-37.43.1fixed
Susecurllinux enterprise server 12 sp1-ltss7.37.0-37.43.1fixed
Susecurllinux enterprise server 12 sp2-ltss7.37.0-37.43.1fixed
Susecurllinux enterprise server 12 sp2-bcl7.37.0-37.43.1fixed
Susecurllinux enterprise server 12 sp3-ltss7.37.0-37.43.1fixed
Susecurllinux enterprise server 12 sp3-bcl7.37.0-37.43.1fixed
Susecurlenterprise storage 47.37.0-37.43.1fixed
Susecurlenterprise storage 57.37.0-37.43.1fixed
Susecurl-openssl1linux enterprise server 11-security7.37.0-70.44.1fixed
Susecurllinux enterprise point of sale 11 sp37.37.0-70.44.1fixed
Susecurllinux enterprise server 11 sp4-ltss7.37.0-70.44.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancurlsourcesid7.66.0-1not yet assignedNot reported[940010]
Debiancurlsourceforky7.66.0-1not yet assignedNot reported[940010]
Debiancurlsourcetrixie7.66.0-1not yet assignedNot reported[940010]
Debiancurlsourcebookworm7.66.0-1not yet assignedNot reported[940010]
Alpinecurlapk3.107.66.0-r0Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.117.66.0-r0Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.127.66.0-r0Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.137.66.0-r0Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.147.66.0-r0Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.157.66.0-r0Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.167.66.0-r0Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.177.66.0-r0Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.187.66.0-r0Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.197.66.0-r0Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.207.66.0-r0Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.217.66.0-r0Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.227.66.0-r0Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.237.66.0-r0Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.247.66.0-r0Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.77.61.1-r3Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.87.61.1-r3Not reportedALPINE-CVE-2019-5482Not reported
Alpinecurlapk3.97.64.0-r3Not reportedALPINE-CVE-2019-5482Not reported
Ubuntucurldebpro7.35.0-1ubuntu2.20+esm3Not reportedUSN-4129-2Not reported
Ubuntucurldebpro7.35.0-1ubuntu2.20+esm3Not reportedUBUNTU-CVE-2019-5482Not reported
Ubuntucurldeb16.047.47.0-1ubuntu2.14Not reportedUBUNTU-CVE-2019-5482Not reported
Ubuntucurldeb18.047.58.0-2ubuntu3.8Not reportedUBUNTU-CVE-2019-5482Not reported
Susecurlrpmhpe helion openstack 87.37.0-37.43.1Not reportedSUSE-SU-2019:2339-2Not reported
Susecurlrpmopenstack cloud 77.37.0-37.43.1Not reportedSUSE-SU-2019:2339-2Not reported
Susecurlrpmopenstack cloud 87.37.0-37.43.1Not reportedSUSE-SU-2019:2339-2Not reported
Susecurlrpmopenstack cloud crowbar 87.37.0-37.43.1Not reportedSUSE-SU-2019:2339-2Not reported
Susecurlrpmlinux enterprise server for sap applications 12 sp17.37.0-37.43.1Not reportedSUSE-SU-2019:2339-2Not reported
Susecurlrpmlinux enterprise server for sap applications 12 sp27.37.0-37.43.1Not reportedSUSE-SU-2019:2339-2Not reported
Susecurlrpmlinux enterprise server for sap applications 12 sp37.37.0-37.43.1Not reportedSUSE-SU-2019:2339-2Not reported
Susecurlrpmlinux enterprise server 12 sp1-ltss7.37.0-37.43.1Not reportedSUSE-SU-2019:2339-2Not reported
Susecurlrpmlinux enterprise server 12 sp2-ltss7.37.0-37.43.1Not reportedSUSE-SU-2019:2339-2Not reported
Susecurlrpmlinux enterprise server 12 sp2-bcl7.37.0-37.43.1Not reportedSUSE-SU-2019:2339-2Not reported
Susecurlrpmlinux enterprise server 12 sp3-ltss7.37.0-37.43.1Not reportedSUSE-SU-2019:2339-2Not reported
Susecurlrpmlinux enterprise server 12 sp3-bcl7.37.0-37.43.1Not reportedSUSE-SU-2019:2339-2Not reported
Susecurlrpmenterprise storage 47.37.0-37.43.1Not reportedSUSE-SU-2019:2339-2Not reported
Susecurlrpmenterprise storage 57.37.0-37.43.1Not reportedSUSE-SU-2019:2339-2Not reported
Susecurl-openssl1rpmlinux enterprise server 11-security7.37.0-70.44.1Not reportedSUSE-SU-2019:14172-1Not reported
Susecurlrpmlinux enterprise point of sale 11 sp37.37.0-70.44.1Not reportedSUSE-SU-2019:14172-1Not reported
Susecurlrpmlinux enterprise server 11 sp4-ltss7.37.0-70.44.1Not reportedSUSE-SU-2019:14172-1Not reported

[Debian bug #940010]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [curl]Unknown
    Details (6)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

  • Source package: [curl]

    Details (6)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

  • [libcurl3-nss]Unknown

    Source package: [curl]

    Details (4)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

  • [libcurl4]Unknown

    Source package: [curl]

    Details (6)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

  • [libcurl4-doc]Unknown

    Source package: [curl]

    Details (6)
    • 7.88.1-10+deb12u15 · all · bookworm

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u15 · all · bookworm

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · all · bookworm-backports

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · all · bookworm-backports

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · all · bookworm-security

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · all · bookworm-security

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

  • Source package: [curl]

    Details (6)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

  • Source package: [curl]

    Details (4)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

  • Source package: [curl]

    Details (6)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.66.0-1

      dsa · curl · debian · bookworm

Observed:

References