---

CVE-2019-19977 - log back

CVE-2019-19977 edited at 19 Jun 2021 07:30:43
Severity	- Unknown + High
Remote	- Unknown + Remote
Type	- Unknown + Arbitrary code execution
Description	+ libESMTP before version 1.1.0 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c. During NTLM authentication, a sufficiently long domain, workstation or user name would overwrite the stack. Furthermore, nt_unicode() is called with an incorrect length argument, potentially causing it to read uninitialised memory or possibly a SIGSEGV or SIGBUS under the same circumstances.
References	+ https://github.com/libesmtp/libESMTP/issues/6 + https://github.com/libesmtp/libESMTP/commit/8c85278d28ff4da32106714a1420371fe37ef349
Notes

CVE-2019-19977 created at 19 Jun 2021 07:23:37