CVE-2019-20503 json
usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.
published 6y ago modified 4mo ago also EUVD-2019-11047
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.1%
- EPSS 3.1% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.
Patch / fix
- usrsctp_project usrsctp 0.9.4.0
- chromium Debian 14, Debian 13, Debian 12 80.0.3987.149-1
- libusrsctp Debian 14, Debian 13, Debian 12 0.9.3.0+20200312-1
- firefox-esr Debian 14, Debian 13, Debian 12 68.6.0esr-1
- thunderbird Debian 14, Debian 13, Debian 12 1:68.6.0-1
debian advisories DEBIAN-CVE-2019-20503
- firefox Ubuntu 16.04 LTS 74.0+build3-0ubuntu0.16.04.1
- firefox Ubuntu 18.04 LTS 74.0+build3-0ubuntu0.18.04.1
- firefox Ubuntu 20.04 LTS 74.0+build3-0ubuntu1
- thunderbird Ubuntu 16.04 LTS 1:68.7.0+build1-0ubuntu0.16.04.2
- thunderbird Ubuntu 18.04 LTS 1:68.7.0+build1-0ubuntu0.18.04.1
- thunderbird Ubuntu 20.04 LTS 1:68.6.0+build2-0ubuntu1
- chromium-browser Ubuntu 16.04 LTS 80.0.3987.149-0ubuntu0.16.04.1
- chromium-browser Ubuntu 18.04 LTS 80.0.3987.149-0ubuntu0.18.04.1
ubuntu advisories UBUNTU-CVE-2019-20503
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- thunderbird RHEL 8 68.6.0-1.el8_1
- thunderbird RHEL 6 68.6.0-1.el6_10
- thunderbird RHEL 7 68.6.0-1.el7_7
- firefox RHEL 8 68.6.0-1.el8_1
- firefox RHEL 7 68.6.0-1.el7_7
- firefox RHEL 6 68.6.0-1.el6_10
- chromium-browser RHEL 6 EXTRAS 80.0.3987.149-1.el6_10
- thunderbird RHEL 8.0 E4S 68.6.0-1.el8_0
red hat advisories RHSA-2020:0919RHSA-2020:0914RHSA-2020:0918RHSA-2020:0905RHSA-2020:0820RHSA-2020:0819
- MozillaThunderbird SLE Workstation Extension 15 SP1 68.6.0-3.74.1
- MozillaFirefox SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +16 more 68.6.0-109.110.1
- MozillaFirefox SLE Module for Desktop Applications 15 SP1 68.6.0-3.75.1
- MozillaFirefox SLES 11 SP4-LTSS 68.6.0-78.64.1
suse advisories SUSE-SU-2020:0721-1SUSE-SU-2020:0717-1SUSE-SU-2020:0686-1SUSE-SU-2020:14312-1
- firefox-esr openSUSE Tumbleweed 128.5.1-1.1
- MozillaFirefox openSUSE Tumbleweed 92.0-1.2
- MozillaThunderbird openSUSE Tumbleweed 91.1.1-1.1
- chromium openSUSE Tumbleweed 93.0.4577.82-1.1
- chromium openSUSE Tumbleweed 113.0.5672.92-1.1
- chromium Package Hub 15 SP1 80.0.3987.149-bp151.3.63.3
- MozillaThunderbird openSUSE Leap 15.1 68.6.0-lp151.2.28.1
- chromium Package Hub 12 SP3, openSUSE Leap 15.1 80.0.3987.149-41.1
opensuse advisories openSUSE-SU-2024:14572-1openSUSE-SU-2024:10600-1openSUSE-SU-2024:10601-1openSUSE-SU-2024:10681-1openSUSE-SU-2024:12948-1openSUSE-SU-2020:0389-1
- firefox Alpine 3.23, Alpine 3.22, Alpine 3.21 +9 more 74.0-r0
- mozjs68 Alpine 3.12 68.6.0-r0
- chromium Alpine 3.11 80.0.3987.149-r0
- librewolf Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 74.0-r0
- firefox-esr Alpine 3.23, Alpine 3.22, Alpine 3.21 +10 more 68.6.0-r0
- thunderbird Alpine 3.23, Alpine 3.22, Alpine 3.21 +5 more 68.6.0-r0
alpine advisories ALPINE-CVE-2019-20503
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- usrsctp CBL-Mariner 2.0, Azure Linux 3.0 0.9.5.0-1
azure linux advisories AZL-35345AZL-9920
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Is CVE-2019-20503 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2019-20503 updated cvss 6.1
usrsctp: Out of bounds reads in sctp_load_addresses_from_init()
-
Red Hat Enterprise Linux 5 firefox, thunderbirdaffected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux AppStream (v. 8) firefox 68.6.0-1.el8_1, thunderbird 68.6.0-1.el8_1fixed: vendor fix RHSA-2020:0820
-
Red Hat Enterprise Linux AppStream E4S (v. 8.0) firefox 68.6.0-1.el8_0, thunderbird 68.6.0-1.el8_0fixed: vendor fix RHSA-2020:0819
-
Red Hat Enterprise Linux Client (v. 7) firefox 68.6.0-1.el7_7, thunderbird 68.6.0-1.el7_7 Red Hat Enterprise Linux Client Optional (v. 7) firefox 68.6.0-1.el7_7fixed: vendor fix RHSA-2020:0815
-
Red Hat Enterprise Linux Desktop (v. 6) firefox 68.6.0-1.el6_10, thunderbird 68.6.0-1.el6_10 Red Hat Enterprise Linux Desktop Optional (v. 6) firefox 68.6.0-1.el6_10fixed: vendor fix RHSA-2020:0816
-
Red Hat Enterprise Linux Desktop Supplementary (v. 6) chromium-browser 80.0.3987.149-1.el6_10fixed: vendor fix RHSA-2020:1270
-
Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox 68.6.0-1.el6_10fixed: vendor fix RHSA-2020:0816
-
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) chromium-browser 80.0.3987.149-1.el6_10fixed: vendor fix RHSA-2020:1270
show 10 moreshow fewer
-
Red Hat Enterprise Linux Server (v. 6) firefox 68.6.0-1.el6_10fixed: vendor fix RHSA-2020:0816
-
Red Hat Enterprise Linux Server (v. 7) firefox 68.6.0-1.el7_7fixed: vendor fix RHSA-2020:0815
-
Red Hat Enterprise Linux Server Optional (v. 6) firefox 68.6.0-1.el6_10, thunderbird 68.6.0-1.el6_10fixed: vendor fix RHSA-2020:0816
-
Red Hat Enterprise Linux Server Optional (v. 7) firefox 68.6.0-1.el7_7, thunderbird 68.6.0-1.el7_7fixed: vendor fix RHSA-2020:0815
-
Red Hat Enterprise Linux Server Supplementary (v. 6) chromium-browser 80.0.3987.149-1.el6_10fixed: vendor fix RHSA-2020:1270
-
Red Hat Enterprise Linux Workstation (v. 6) firefox 68.6.0-1.el6_10, thunderbird 68.6.0-1.el6_10fixed: vendor fix RHSA-2020:0816
-
Red Hat Enterprise Linux Workstation (v. 7) firefox 68.6.0-1.el7_7, thunderbird 68.6.0-1.el7_7fixed: vendor fix RHSA-2020:0815
-
Red Hat Enterprise Linux Workstation Optional (v. 6) firefox 68.6.0-1.el6_10fixed: vendor fix RHSA-2020:0816
-
Red Hat Enterprise Linux Workstation Optional (v. 7) firefox 68.6.0-1.el7_7fixed: vendor fix RHSA-2020:0815
-
Red Hat Enterprise Linux Workstation Supplementary (v. 6) chromium-browser 80.0.3987.149-1.el6_10fixed: vendor fix RHSA-2020:1270
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
3.14% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- bugs.chromium.org https://bugs.chromium.org/p/project-zero/issues/detail?id=1992 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Classification
- Weakness
-
- CWE-125 Out-of-bounds Read
References
-
github.com
/sctplab/usrsctp/commit/790a7a2555aefb392a5a69923f1e9d17b4968467
patch, third-party-advisory
-
bugs.chromium.org
/p/project-zero/issues/detail?id=1992
exploit, patch, vendor-advisory
-
debian.org
/security/2020/dsa-4639
vendor-advisory, third-party-advisory
-
security.gentoo.org
/glsa/202003-02
vendor-advisory, third-party-advisory
-
security.gentoo.org
/glsa/202003-10
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-03/msg00022.html
vendor-advisory, mailing-list, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0815
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0819
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0816
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0820
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/4299-1/
vendor-advisory, third-party-advisory
-
debian.org
/security/2020/dsa-4642
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-03/msg00028.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-03/msg00030.html
vendor-advisory, mailing-list, third-party-advisory
-
debian.org
/security/2020/dsa-4645
vendor-advisory, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/JWANFIR3PYAL5RJQ4AO3ZS2DYMSF2ZGZ/
vendor-advisory, mailing-list, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/2DDNOAGIX5D77TTHT6YPMVJ5WTXTCQEI/
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-03/msg00037.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/
vendor-advisory, mailing-list, third-party-advisory
-
usn.ubuntu.com
/4328-1/
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/4335-1/
vendor-advisory, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2020/03/msg00013.html
mailing-list, third-party-advisory
-
crbug.com
/1059349
third-party-advisory
-
chromereleases.googleblog.com
/2020/03/stable-channel-update-for-desktop_18.html
third-party-advisory
-
lists.debian.org
/debian-lts-announce/2020/03/msg00023.html
mailing-list, third-party-advisory
-
support.apple.com
/kb/HT211175
third-party-advisory
-
support.apple.com
/kb/HT211171
third-party-advisory
-
support.apple.com
/kb/HT211168
third-party-advisory
-
support.apple.com
/kb/HT211177
third-party-advisory
-
seclists.org
/fulldisclosure/2020/May/49
mailing-list, third-party-advisory
-
seclists.org
/fulldisclosure/2020/May/52
mailing-list, third-party-advisory
-
seclists.org
/fulldisclosure/2020/May/55
mailing-list, third-party-advisory
-
seclists.org
/fulldisclosure/2020/May/59
mailing-list, third-party-advisory
-
support.apple.com
/HT211168
third-party-advisory
-
support.apple.com
/HT211171
third-party-advisory
-
support.apple.com
/HT211175
third-party-advisory
-
support.apple.com
/HT211177
third-party-advisory
-
lists.debian.org
/debian-lts-announce/2023/07/msg00003.html
mailing-list, third-party-advisory
Sources
- CVE List CVE-2019-20503
- NVD CVE-2019-20503
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.