CVE-2019-5600
Estado: ModificadaCrítica (9.8)—
In FreeBSD 12.0-STABLE before r349622, 12.0-RELEASE before 12.0-RELEASE-p7, 11.3-PRERELEASE before r349624, 11.3-RC3 before 11.3-RC3-p1, and 11.2-RELEASE before 11.2-RELEASE-p11, a bug in iconv implementation may allow an attacker to write past the end of an output buffer. Depending on the implementation, an attacker may be able to create a denial of service, provoke incorrect program behavior, or induce a remote code execution.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 4.86%
- Percentil entre todas las CVEs puntuadas: 92
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-787
Referencias
- http://packetstormsecurity.com/files/153520/FreeBSD-Security-Advisory-FreeBSD-SA-19-09.iconv.html
- https://security.FreeBSD.org/advisories/FreeBSD-SA-19:09.iconv.asc
- http://packetstormsecurity.com/files/153520/FreeBSD-Security-Advisory-FreeBSD-SA-19-09.iconv.html
- https://security.FreeBSD.org/advisories/FreeBSD-SA-19:09.iconv.asc
JSON original (NVD)
Mostrar
{
"id": "CVE-2019-5600",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "secteam@freebsd.org",
"affectedData": [
{
"vendor": "FreeBSD",
"product": "FreeBSD",
"versions": [
{
"status": "affected",
"version": "FreeBSD 12.0 before 12.0-RELEASE-p7 and 11.2 before 11.2-RELEASE-p11"
}
]
}
]
}
],
"published": "2019-07-03T19:15:12.783",
"references": [
{
"url": "http://packetstormsecurity.com/files/153520/FreeBSD-Security-Advisory-FreeBSD-SA-19-09.iconv.html",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "secteam@freebsd.org"
},
{
"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-19:09.iconv.asc",
"tags": [
"Vendor Advisory"
],
"source": "secteam@freebsd.org"
},
{
"url": "http://packetstormsecurity.com/files/153520/FreeBSD-Security-Advisory-FreeBSD-SA-19-09.iconv.html",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-19:09.iconv.asc",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In FreeBSD 12.0-STABLE before r349622, 12.0-RELEASE before 12.0-RELEASE-p7, 11.3-PRERELEASE before r349624, 11.3-RC3 before 11.3-RC3-p1, and 11.2-RELEASE before 11.2-RELEASE-p11, a bug in iconv implementation may allow an attacker to write past the end of an output buffer. Depending on the implementation, an attacker may be able to create a denial of service, provoke incorrect program behavior, or induce a remote code execution."
},
{
"lang": "es",
"value": "En FreeBSD 12.0-ESTABLE en versiones anteriores a la r349622, 12.0-RELEASE en versiones anteriores a la 12.0-RELEASE-p7, 11.3-PRERELEASE en versiones anteriores a la r349624, 11.3-RC3 en versiones anteriores a la 11.3-RC3-p1, y 11.2-RELEASE en versiones anteriores a la 11.2-RELEASE-p11, un error en la implementación de iconv puede permitir que un atacante escriba más allá del final de un búfer de salida. Dependiendo de la implementación, un atacante puede crear una denegación de servicio, provocar un comportamiento incorrecto del programa o inducir una ejecución remota de código."
}
],
"lastModified": "2026-06-17T02:37:55.180",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:freebsd:freebsd:11.2:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3ACD1D8D-B3BC-4E99-B846-90A4071DB87B"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:11.2:p10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0A8A5CDA-E099-47BA-A0C0-2F79C0432156"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:11.2:p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "699FE432-8DF0-49F1-A98B-0E19CE01E5CE"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:11.2:p3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "20B06752-39EE-4600-AC1F-69FB9C88E2A8"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:11.2:p4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "22365F7C-2B00-4B61-84E8-EFBA3B8CFDC0"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:11.2:p5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E86CD544-86C4-4D9D-9CE5-087027509EDA"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:11.2:p6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "64E47AE7-BB45-428E-90E9-38BFDFF23650"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:11.2:p7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "586B9FA3-65A2-41EB-A848-E4A75565F0CA"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:11.2:p9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F0B15B89-3AD2-4E03-9F47-DA934702187B"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:11.2:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "878DF67E-420A-4229-BEA8-DB9F7161ED9A"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:11.3:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E03E6445-DD63-44E8-85D1-3971253F395A"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:12.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "826B53C2-517F-4FC6-92E8-E7FCB24F91B4"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:12.0:p1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "93F10A46-AEF2-4FDD-92D6-0CF07B70F986"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:12.0:p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E1AD57A9-F53A-4E40-966E-F2F50852C5E4"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:12.0:p3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C4029113-130F-4A33-A8A0-BC3E74000378"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:12.0:p4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "46C5A6FD-7BBF-4E84-9895-8EE14DC846E4"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:12.0:p5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6D71D083-3279-4DF4-91E1-38C373DD062F"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:12.0:p6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "882669AB-BCFC-4517-A3E9-33D344F1ED0D"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secteam@freebsd.org"
}