PT-2019-13707 · Libmodbus+3 · Libmodbus+3

Published 2019-07-31 · Updated 2021-12-09 · CVE-2019-14463

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions libmodbus versions 3.0.6 and earlier libmodbus versions 3.1.x before 3.1.5

Description An issue was discovered in libmodbus. There is an out-of-bounds read for the MODBUS FC WRITE MULTIPLE REGISTERS case.

Recommendations For libmodbus versions 3.0.6 and earlier, update to version 3.0.7 or later. For libmodbus versions 3.1.x before 3.1.5, update to version 3.1.5 or later.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2019-3031

ALT-PU-2020-2703

CVE-2019-14463

DLA-2825-1

USN-5173-1

USN-5173-2

Affected Products

Alt Linux

Astra Linux

Ubuntu

Libmodbus

References · 19

• https://github.com/stephane/libmodbus/commit/5ccdf5ef79d742640355d1132fa9e2abc7fbaefc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-14463 · Security Note
• https://osv.dev/vulnerability/USN-5173-2 · Vendor Advisory
• https://libmodbus.org/2019/stable-and-development-releases · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14463 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14462 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5173-2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAGHQFJTJCMYHW553OUWJ3YIJR6PJHB7 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRAQZXGAZY6UGWZ6CD33QEFLL7AWW233 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14463 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2825-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5173-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-14463 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5173-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14463 · Vendor Advisory