CVE-2019-19958
CVE-2019-19958 is a medium-severity vulnerability in Mz-automation Libiec61850 with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-681.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- CVSS v2: 4.3
- EPSS exploit prediction: 1% (56th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-681
- Affected product: Mz-automation Libiec61850
- Published:
- Last modified:
Description
In libIEC61850 1.4.0, StringUtils_createStringFromBuffer in common/string_utilities.c has an integer signedness issue that could lead to an attempted excessive memory allocation and denial of service.
Frequently asked questions
- What is CVE-2019-19958?
- In libIEC61850 1.4.0, StringUtils_createStringFromBuffer in common/string_utilities.c has an integer signedness issue that could lead to an attempted excessive memory allocation and denial of service.
- How severe is CVE-2019-19958?
- CVE-2019-19958 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2019-19958 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2019-19958?
- CVE-2019-19958 affects Mz-automation Libiec61850. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2019-19958?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2019-19958 published?
- CVE-2019-19958 was published on 2019-12-24 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:mz-automation:libiec61850:1.4.0:*:*:*:*:*:*:*
More vulnerabilities in Mz-automation Libiec61850
- CVE-2022-2972 — Critical (CVSS 10.0): MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit…
- CVE-2022-2970 — Critical (CVSS 10.0): MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit…
- CVE-2024-45971 — Critical (CVSS 9.8): Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit…
- CVE-2024-45970 — Critical (CVSS 9.8): Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit…
- CVE-2018-19185 — Critical (CVSS 9.8): An issue has been found in libIEC61850 v1.3. It is a heap-based buffer overflow in BerEncoder_encodeOctetString in…
- CVE-2018-18957 — Critical (CVSS 9.8): An issue has been found in libIEC61850 v1.3. It is a stack-based buffer overflow in prepareGooseBuffer in…
All CVEs affecting Mz-automation Libiec61850 →
Other CWE-681 vulnerabilities
- CVE-2022-40138 — Critical (CVSS 9.8): An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097,…
- CVE-2021-36357 — Critical (CVSS 9.8): An issue was discovered in OpenPOWER 2.6 firmware. unpack_timestamp() calls le32_to_cpu() for endian conversion of a…
- CVE-2021-38187 — Critical (CVSS 9.8): An issue was discovered in the anymap crate through 0.12.1 for Rust. It violates soundness via conversion of a *u8 to a…
- CVE-2019-19317 — Critical (CVSS 9.8): lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which…
- CVE-2019-14842 — Critical (CVSS 9.8): Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks. A bounds…
- CVE-2018-8786 — Critical (CVSS 9.8): FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in…