CVE-2019-20503

Quick assessment

Copy summary Copy citation

Affected

n/a n/a

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

usrsctp是一款支持多平台的用户级SCTP（流控制传输协议）堆栈。 usrsctp 2019-12-20之前版本中的sctp_load_addresses_from_init存在缓冲区错误漏洞。该漏洞源于网络系统或产品在内存上执行操作时，未正确验证数据边界，导致向关联的其他内存位置上执行了错误的读写操作。攻击者可利用该漏洞导致缓冲区溢出或堆溢出等。

CVE-2019-20503 affects n/a n/a. No confirmed in-the-wild exploitation; assess based on exposure. usrsctp是一款支持多平台的用户级SCTP（流控制传输协议）堆栈。 usrsctp 2019-12-20之前版本中的sctp_load_addresses_from_init存在缓冲区错误漏洞。该漏洞源于网络系统或产品在内存上执行操作时，未正确验证数据边界，导致向关联的其他内存位置上执行了错误的读写操作。攻击者可利用该漏洞导致缓冲区溢出或堆溢出等。 CVE-2019-20503 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2019-20503

I. Basic Information for CVE-2019-20503

Affected Products

II. Public POCs for CVE-2019-20503

III. Intelligence Information for CVE-2019-20503

Patches & Fixes for CVE-2019-20503 (1)

• https://github.com/sctplab/usrsctp/commit/790a7a2555aefb392a5a69923f1e9d17b4968467

Vendor Advisories for CVE-2019-20503 (20)

• https://support.apple.com/HT211171
• https://support.apple.com/kb/HT211177
• 🔗 About the security content of watchOS 6.2.5 - Apple Support Read full article
• https://support.apple.com/kb/HT211175
• https://support.apple.com/HT211168
• https://support.apple.com/HT211177
• https://support.apple.com/kb/HT211171
• https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_18.html
• https://support.apple.com/kb/HT211168
• https://www.debian.org/security/2020/dsa-4645 vendor-advisory
• https://www.debian.org/security/2020/dsa-4639 vendor-advisory
• https://usn.ubuntu.com/4328-1/ vendor-advisory
• https://usn.ubuntu.com/4335-1/ vendor-advisory
• https://usn.ubuntu.com/4299-1/ vendor-advisory
• https://access.redhat.com/errata/RHSA-2020:0819 vendor-advisory
• https://security.gentoo.org/glsa/202003-02 vendor-advisory
• https://security.gentoo.org/glsa/202003-10 vendor-advisory
• https://access.redhat.com/errata/RHSA-2020:0820 vendor-advisory
• https://access.redhat.com/errata/RHSA-2020:0815 vendor-advisory
• https://access.redhat.com/errata/RHSA-2020:0816 vendor-advisory

Mailing List Discussions for CVE-2019-20503 (14)

• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00037.html vendor-advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00028.html vendor-advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00022.html vendor-advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00030.html vendor-advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/ vendor-advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWANFIR3PYAL5RJQ4AO3ZS2DYMSF2ZGZ/ vendor-advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DDNOAGIX5D77TTHT6YPMVJ5WTXTCQEI/ vendor-advisory
• http://seclists.org/fulldisclosure/2020/May/59 mailing-list
• http://seclists.org/fulldisclosure/2020/May/55 mailing-list
• http://seclists.org/fulldisclosure/2020/May/52 mailing-list
• http://seclists.org/fulldisclosure/2020/May/49 mailing-list
• https://lists.debian.org/debian-lts-announce/2023/07/msg00003.html mailing-list
• https://lists.debian.org/debian-lts-announce/2020/03/msg00013.html mailing-list
• https://lists.debian.org/debian-lts-announce/2020/03/msg00023.html mailing-list

Other References for CVE-2019-20503 (1)

• https://bugs.chromium.org/p/project-zero/issues/detail?id=1992

• https://www.cve.org/CVERecord?id=CVE-2019-20503

Same Patch Batch · n/a · 2020-03-06 · 22 CVEs total

Showing top 20 of 22 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

V. Comments for CVE-2019-20503