CVE-2019-20892

Description

net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

0.501

Associated Vulnerability

Vulnerability	OS Platform
SNMP (Simple Network Management Protocol) server and applications (USN-4410-1) snmpd_5.8+dfsg-2ubuntu2.1_i386.deb	Linux
SNMP (Simple Network Management Protocol) server and applications (USN-4410-1) snmpd_5.8+dfsg-2ubuntu2.1_amd64.deb	Linux
SNMP (Simple Network Management Protocol) server and applications (USN-4410-1) libsnmp35_5.8+dfsg-2ubuntu2.1_i386.deb	Linux
SNMP (Simple Network Management Protocol) server and applications (USN-4410-1) libsnmp35_5.8+dfsg-2ubuntu2.1_amd64.deb	Linux
SNMP (Simple Network Management Protocol) server and applications (USN-4410-1) libsnmp-base_5.8+dfsg-2ubuntu2.1_all.deb	Linux
SNMP (Simple Network Management Protocol) server and applications (USN-4410-1) libsnmp-perl_5.8+dfsg-2ubuntu2.1_i386.deb	Linux
SNMP (Simple Network Management Protocol) server and applications (USN-4410-1) libsnmp-perl_5.8+dfsg-2ubuntu2.1_amd64.deb	Linux
Double Free Vulnerability (CVE-2019-20892)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234