usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.

Description

usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.

Scores

EPSS (exploitation in 30 days)

3.1% · top 12% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

• n/a
• CWE-125 (opens in a new tab)All about CWE-125 and its CVEs

Affected products

• n/a

  • affected n/a

References (38)

• https://bugs.chromium.org/p/project-zero/issues/detail?id=1992 (opens in a new tab)x_transferred
• https://github.com/sctplab/usrsctp/commit/790a7a2555aefb392a5a69923f1e9d17b4968467 (opens in a new tab)x_transferred
• [debian-lts-announce] 20200311 [SECURITY] [DLA 2140-1] firefox-esr security update (opens in a new tab)mailing-listx_transferred
• DSA-4639 (opens in a new tab)vendor-advisoryx_transferred
• GLSA-202003-02 (opens in a new tab)vendor-advisoryx_transferred
• GLSA-202003-10 (opens in a new tab)vendor-advisoryx_transferred
• openSUSE-SU-2020:0340 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2020:0815 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2020:0819 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2020:0816 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2020:0820 (opens in a new tab)vendor-advisoryx_transferred
• USN-4299-1 (opens in a new tab)vendor-advisoryx_transferred
• https://crbug.com/1059349 (opens in a new tab)x_transferred
• https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_18.html (opens in a new tab)x_transferred
• [debian-lts-announce] 20200320 [SECURITY] [DLA 2150-1] thunderbird security update (opens in a new tab)mailing-listx_transferred
• DSA-4642 (opens in a new tab)vendor-advisoryx_transferred
• openSUSE-SU-2020:0365 (opens in a new tab)vendor-advisoryx_transferred
• openSUSE-SU-2020:0366 (opens in a new tab)vendor-advisoryx_transferred
• DSA-4645 (opens in a new tab)vendor-advisoryx_transferred
• FEDORA-2020-7fd051b378 (opens in a new tab)vendor-advisoryx_transferred
• FEDORA-2020-17149a4f3d (opens in a new tab)vendor-advisoryx_transferred
• openSUSE-SU-2020:0389 (opens in a new tab)vendor-advisoryx_transferred
• FEDORA-2020-39e0b8bd14 (opens in a new tab)vendor-advisoryx_transferred
• USN-4328-1 (opens in a new tab)vendor-advisoryx_transferred
• USN-4335-1 (opens in a new tab)vendor-advisoryx_transferred
• https://support.apple.com/kb/HT211175 (opens in a new tab)x_transferred
• https://support.apple.com/kb/HT211171 (opens in a new tab)x_transferred
• https://support.apple.com/kb/HT211168 (opens in a new tab)x_transferred
• https://support.apple.com/kb/HT211177 (opens in a new tab)x_transferred
• 20200529 APPLE-SA-2020-05-26-1 iOS 13.5 and iPadOS 13.5 (opens in a new tab)mailing-listx_transferred
• 20200529 APPLE-SA-2020-05-26-7 Safari 13.1.1 (opens in a new tab)mailing-listx_transferred
• 20200529 APPLE-SA-2020-05-26-5 watchOS 6.2.5 (opens in a new tab)mailing-listx_transferred
• 20200529 APPLE-SA-2020-05-26-4 tvOS 13.4.5 (opens in a new tab)mailing-listx_transferred
• https://support.apple.com/HT211168 (opens in a new tab)x_transferred
• https://support.apple.com/HT211171 (opens in a new tab)x_transferred
• https://support.apple.com/HT211175 (opens in a new tab)x_transferred
• https://support.apple.com/HT211177 (opens in a new tab)x_transferred
• [debian-lts-announce] 20230706 [SECURITY] [DLA 3481-1] libusrsctp security update (opens in a new tab)mailing-listx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-20503](https://trackcve.app/badge/CVE-2019-20503.svg)](https://trackcve.app/cve/CVE-2019-20503)

Record last updated 5 Aug 2024, 02:46 UTC.