PT-2019-13706 · Libmodbus+3 · Libmodbus+3

Published 2019-07-31 · Updated 2021-12-09 · CVE-2019-14462

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions libmodbus versions 3.0.0 through 3.0.6 libmodbus versions 3.1.0 through 3.1.4

Description An issue was discovered in libmodbus. There is an out-of-bounds read for the MODBUS FC WRITE MULTIPLE COILS case.

Recommendations For libmodbus versions 3.0.0 through 3.0.6, update to version 3.0.7 or later. For libmodbus versions 3.1.0 through 3.1.4, update to version 3.1.5 or later.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2019-3031

ALT-PU-2020-2703

CVE-2019-14462

DLA-2825-1

USN-5173-1

USN-5173-2

Affected Products

Alt Linux

Astra Linux

Ubuntu

Libmodbus

References · 18

• https://github.com/stephane/libmodbus/commit/5ccdf5ef79d742640355d1132fa9e2abc7fbaefc · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14462 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14462 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5173-2 · Vendor Advisory
• https://libmodbus.org/2019/stable-and-development-releases · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14462 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5173-2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAGHQFJTJCMYHW553OUWJ3YIJR6PJHB7 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRAQZXGAZY6UGWZ6CD33QEFLL7AWW233 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14462 · Security Note
• https://osv.dev/vulnerability/DLA-2825-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5173-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-14462 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5173-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14463 · Vendor Advisory