CVE-2019-5544

Scores

EPSS

0.925high92.5%
0%20%40%60%80%100%

Percentile: 92.5%

CVSS

9.8critical3.x
0246810

CVSS Score: 9.8/10

All CVSS Scores

CVSS 3.x
9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0
7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debiannvdredhatubuntu

CWEs

CWE-122CWE-787

Related Vulnerabilities

Exploits

Exploit ID: CVE-2019-5544

Source: github-poc

URL: https://github.com/HynekPetrak/CVE-2019-5544_CVE-2020-3992

Recommendations

Source: nvd

Gentoo has discontinued support for OpenSLP. We recommend that users
unmerge OpenSLP:

# emerge –unmerge “net-libs/openslp”

NOTE: The Gentoo developer(s) maintaining OpenSLP have discontinued
support at this time. It may be possible that a new Gentoo developer
will update OpenSLP at a later date. No known alternatives to OpenSLP
are in the tree at this time.

URL: https://security.gentoo.org/glsa/202005-12

Source: nvd

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

URL: https://access.redhat.com/errata/RHSA-2020:0199

Source: nvd

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

URL: https://access.redhat.com/errata/RHSA-2019:4240

Vulnerable Software (28)

Type: Configuration

Product: libldap

Operating System: altlinux

Trait:
{  "fixed": "0:2.4.59-alt0.c9.2"}

Source: redhat

Type: Configuration

Product: libldap-devel

Operating System: altlinux

Trait:
{  "fixed": "0:2.4.59-alt0.c9.2"}

Source: redhat

Type: Configuration

Product: libldap-devel-static

Operating System: altlinux

Trait:
{  "fixed": "0:2.4.59-alt0.c9.2"}

Source: redhat

Type: Configuration

Product: openldap-clients

Operating System: altlinux

Trait:
{  "fixed": "0:2.4.59-alt0.c9.2"}

Source: redhat

Type: Configuration

Product: openldap-common

Operating System: altlinux

Trait:
{  "fixed": "0:2.4.59-alt0.c9.2"}

Source: redhat

Type: Configuration

Product: openldap-doc

Operating System: altlinux

Trait:
{  "fixed": "0:2.4.59-alt0.c9.2"}

Source: redhat

Type: Configuration

Product: openldap-servers

Operating System: altlinux

Trait:
{  "fixed": "0:2.4.59-alt0.c9.2"}

Source: redhat

Type: Configuration

Product: openslp

Operating System: rhel 6

Trait:
{  "fixed": "2.0.0-4.el6_10"}

Source: redhat

Type: Configuration

Product: openslp

Operating System: rhel 7

Trait:
{  "fixed": "2.0.0-8.el7_7"}

Source: redhat

Type: Configuration

Product: openslp-dfsg

Operating System: debian

Trait:
{  "unfixed": true}

Source: debian

Type: Configuration

Product: openslp-dfsg

Operating System: ubuntu trusty 14.04

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: openslp-dfsg

Operating System: ubuntu xenial 16.04

Trait:
{  "fixed": "1.2.1-11ubuntu0.16.04.2"}

Source: ubuntu

Type: Configuration

Vendor: *

Product: enterprise_linux_desktop

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_des...

Source: nvd

Type: Configuration

Vendor: *

Product: enterprise_linux_for_ibm_z_systems

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_des...

Source: nvd

Type: Configuration

Vendor: *

Product: enterprise_linux_for_ibm_z_systems_eus

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_des...

Source: nvd

Type: Configuration

Vendor: *

Product: enterprise_linux_for_power_big_endian

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_des...

Source: nvd

Type: Configuration

Vendor: *

Product: enterprise_linux_for_power_big_endian_eus

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_des...

Source: nvd

Type: Configuration

Vendor: *

Product: enterprise_linux_for_power_little_endian

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_des...

Source: nvd

Type: Configuration

Vendor: *

Product: enterprise_linux_for_power_little_endian_eus

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_des...

Source: nvd

Type: Configuration

Vendor: *

Product: enterprise_linux_server

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:redhat:enterprise_linux_des...

Source: nvd