CVE-2019-11596

Published: 29 April 2019

In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c.

Priority

CVSS 3 base score: 7.5

Status

Package	Release	Status
memcached Launchpad, Ubuntu, Debian	Upstream	Released (1.5.14)




	Ubuntu 18.04 LTS (Bionic Beaver)	Released (1.5.6-0ubuntu1.1)
	Ubuntu 16.04 ESM (Xenial Xerus)	Not vulnerable (code not present)
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
	Patches: Upstream: https://github.com/memcached/memcached/commit/d35334f368817a77a6bd1f33c6a5676b2c402c02

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11596
https://ubuntu.com/security/notices/USN-3963-1
NVD
Launchpad
Debian

Bugs

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928205
https://github.com/memcached/memcached/issues/474

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM