CVE-2019-16159

BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8203 administrative shutdown communication messages included an incorrect logical expression when checking the validity of an input message. Sending a shutdown communication with a sufficient message length causes a four-byte overflow to occur while processing the message, where two of the overflow bytes are attacker-controlled and two are fixed.

• CWE-787

• http://bird.network.czVendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00063.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00065.htmlMailing List, Third Party Advisory
• http://trubka.network.cz/pipermail/bird-users/2019-September/013718.htmlVendor Advisory
• http://trubka.network.cz/pipermail/bird-users/2019-September/013720.htmlVendor Advisory
• http://trubka.network.cz/pipermail/bird-users/2019-September/013722.htmlVendor Advisory
• https://gitlab.labs.nic.cz/labs/bird/commit/1657c41c96b3c07d9265b07dd4912033ead4124bPatch, Third Party Advisory
• https://gitlab.labs.nic.cz/labs/bird/commit/8388f5a7e14108a1458fea35bfbb5a453e2c563cPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F23NNAPXX65MGJQBPPTVGRV3T4XCKBV/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MCVNQJBZYGGNAJNGOFEBE3IAJME2QIZB/
• https://seclists.org/bugtraq/2019/Sep/34Mailing List, Third Party Advisory
• https://www.debian.org/security/2019/dsa-4528Third Party Advisory
• http://bird.network.czVendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00063.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00065.htmlMailing List, Third Party Advisory
• http://trubka.network.cz/pipermail/bird-users/2019-September/013718.htmlVendor Advisory
• http://trubka.network.cz/pipermail/bird-users/2019-September/013720.htmlVendor Advisory
• http://trubka.network.cz/pipermail/bird-users/2019-September/013722.htmlVendor Advisory
• https://gitlab.labs.nic.cz/labs/bird/commit/1657c41c96b3c07d9265b07dd4912033ead4124bPatch, Third Party Advisory
• https://gitlab.labs.nic.cz/labs/bird/commit/8388f5a7e14108a1458fea35bfbb5a453e2c563cPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F23NNAPXX65MGJQBPPTVGRV3T4XCKBV/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MCVNQJBZYGGNAJNGOFEBE3IAJME2QIZB/
• https://seclists.org/bugtraq/2019/Sep/34Mailing List, Third Party Advisory
• https://www.debian.org/security/2019/dsa-4528Third Party Advisory

Published

Sep 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16152A Denial of service (DoS) vulnerability in FortiClient for L…6.5
• CVE-2019-16153A hard-coded password vulnerability in the Fortinet FortiSIE…9.8
• CVE-2019-16154An improper neutralization of input during web page generati…6.1
• CVE-2019-16155A privilege escalation vulnerability in FortiClient for Linu…7.1
• CVE-2019-16156An Improper Neutralization of Input vulnerability in the Ano…6.1
• CVE-2019-16157An information exposure vulnerability in Fortinet FortiWeb 6…6.5
• CVE-2019-1616A vulnerability in the Cisco Fabric Services component of Ci…8.6
• CVE-2019-16160An integer underflow in the SMB server of MikroTik RouterOS …7.5
• CVE-2019-16161Onigmo through 6.2.0 has a NULL pointer dereference in onig_…7.5
• CVE-2019-16162Onigmo through 6.2.0 has an out-of-bounds read in parse_char…7.5
• CVE-2019-16163Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c …7.5
• CVE-2019-16164MyHTML through 4.0.5 has a NULL pointer dereference in myhtm…6.5