Skip to content
Fencer Intel
critical 9.8

CVE-2019-19977 json

libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a s…

published 6y ago modified 4mo ago also EUVD-2019-9565

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.0%
EPSS 3.0% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read.

Patch / fix

  • libesmtp SLES 15 SP1-BCL, SLE Module for Basesystem 15 SP3, SLE Module for Basesystem 15 SP2 +14 more 1.0.6-150.4.1
  • libesmtp SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +11 more 1.0.6-17.3.1
  • libesmtp SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 1.0.4-157.18.3.1

suse advisories SUSE-SU-2021:2937-2SUSE-SU-2021:2937-1SUSE-SU-2021:2917-1SUSE-SU-2021:14793-1

  • libesmtp openSUSE Tumbleweed 1.1.0-1.1
  • libesmtp openSUSE Leap 15.2 1.0.6-lp152.4.3.1
  • libesmtp openSUSE Leap 15.3 1.0.6-150.4.1

opensuse advisories openSUSE-SU-2024:12594-1openSUSE-SU-2021:1235-1openSUSE-SU-2021:2937-1

  • libesmtp CBL-Mariner 2.0, Azure Linux 3.0 1.0.6-21

azure linux advisories AZL-36949AZL-7260

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2019-19977 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-19977 updated cvss 7.4

libesmtp: Stack-based buffer over-read in ntlm_build_type_2() in ntlm/ntlmstruct.c

  • Red Hat Enterprise Linux 6 libesmtp Red Hat Enterprise Linux 7 libesmtp
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.97% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/Kirin-say/Vulnerabilities/blob/master/Stack_Overflow_in_libesmtp.md referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/jbouse-debian/libesmtp/blob/ca5bd0800ef1da234315da4c59716568eb5e6402/ntlm/ntlmstruct.c#L228-L242 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.