CVE-2019-17455

Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request.

• CWE-125

• https://lists.opensuse.org/opensuse-security-announce/2020-06/msg00029.htmlMailing List, Third Party Advisory
• https://lists.opensuse.org/opensuse-security-announce/2020-06/msg00032.htmlMailing List, Third Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942145Exploit, Issue Tracking, Mailing List, Third Party Advisory
• https://gitlab.com/jas/libntlm/issues/2Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/05/msg00010.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/11/msg00026.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BVFO3OVJPMSGIXBKNOCVOJZ3UTGZQF5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZ5YWYNOJ5HMCKAHWLTY4MXZQWJJCBI7/
• https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17455.htmlThird Party Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-17455Third Party Advisory
• https://lists.opensuse.org/opensuse-security-announce/2020-06/msg00029.htmlMailing List, Third Party Advisory
• https://lists.opensuse.org/opensuse-security-announce/2020-06/msg00032.htmlMailing List, Third Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942145Exploit, Issue Tracking, Mailing List, Third Party Advisory
• https://gitlab.com/jas/libntlm/issues/2Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/05/msg00010.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/11/msg00026.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BVFO3OVJPMSGIXBKNOCVOJZ3UTGZQF5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZ5YWYNOJ5HMCKAHWLTY4MXZQWJJCBI7/
• https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17455.htmlThird Party Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-17455Third Party Advisory

Published

Oct 10, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1745A vulnerability in Cisco IOS XE Software could allow an auth…7.8
• CVE-2019-17450find_abstract_instance in dwarf2.c in the Binary File Descri…6.5
• CVE-2019-17451An issue was discovered in the Binary File Descriptor (BFD) …6.5
• CVE-2019-17452Bento4 1.5.1.0 has a NULL pointer dereference in AP4_Descrip…6.5
• CVE-2019-17453Bento4 1.5.1.0 has a NULL pointer dereference in AP4_Descrip…6.5
• CVE-2019-17454Bento4 1.5.1.0 has a NULL pointer dereference in AP4_Descrip…6.5
• CVE-2019-1746A vulnerability in the Cluster Management Protocol (CMP) pro…7.4
• CVE-2019-1747A vulnerability in the implementation of the Short Message S…8.6
• CVE-2019-1748A vulnerability in the Cisco Network Plug-and-Play (PnP) age…7.4
• CVE-2019-17488b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP U…6.1
• CVE-2019-17489Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Probl…6.1
• CVE-2019-1749A vulnerability in the ingress traffic validation of Cisco I…7.4