CVE-2019-20503

Exploitation

Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.

SSVC decision

Not assessed by CISA

EPSS probability

3.16% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 86.8% of scored records. A rank, not a probability.

NVD base score

6.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2020-03-06 00:00Z6 YR AGO

Last updated

2024-08-05 02:46Z2 YR AGO

Reserved

2020-03-06

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

• CWE-125Out-of-bounds ReadBase

Data version

5.1

Document digest

aca8b05e5dabb922ad7e1b571a0eefff07fa4e6cb3213ac563c31b86cad767e3

• bugs.chromium.orghttps://bugs.chromium.org/p/project-zero/issues/detail?id=1992
• github.comhttps://github.com/sctplab/usrsctp/commit/790a7a2555aefb392a5a69923f1e9d17b4968467
• lists.debian.org[debian-lts-announce] 20200311 [SECURITY] [DLA 2140-1] firefox-esr security updatehttps://lists.debian.org/debian-lts-announce/2020/03/msg00013.htmlmailing-list
• www.debian.orgDSA-4639https://www.debian.org/security/2020/dsa-4639vendor-advisory
• security.gentoo.orgGLSA-202003-02https://security.gentoo.org/glsa/202003-02vendor-advisory
• security.gentoo.orgGLSA-202003-10https://security.gentoo.org/glsa/202003-10vendor-advisory
• lists.opensuse.orgopenSUSE-SU-2020:0340http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00022.htmlvendor-advisory
• access.redhat.comRHSA-2020:0815https://access.redhat.com/errata/RHSA-2020:0815vendor-advisory
• access.redhat.comRHSA-2020:0819https://access.redhat.com/errata/RHSA-2020:0819vendor-advisory
• access.redhat.comRHSA-2020:0816https://access.redhat.com/errata/RHSA-2020:0816vendor-advisory
• access.redhat.comRHSA-2020:0820https://access.redhat.com/errata/RHSA-2020:0820vendor-advisory
• usn.ubuntu.comUSN-4299-1https://usn.ubuntu.com/4299-1/vendor-advisory
• crbug.comhttps://crbug.com/1059349
• chromereleases.googleblog.comhttps://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_18.html
• lists.debian.org[debian-lts-announce] 20200320 [SECURITY] [DLA 2150-1] thunderbird security updatehttps://lists.debian.org/debian-lts-announce/2020/03/msg00023.htmlmailing-list
• www.debian.orgDSA-4642https://www.debian.org/security/2020/dsa-4642vendor-advisory
• lists.opensuse.orgopenSUSE-SU-2020:0365http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00028.htmlvendor-advisory
• lists.opensuse.orgopenSUSE-SU-2020:0366http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00030.htmlvendor-advisory
• www.debian.orgDSA-4645https://www.debian.org/security/2020/dsa-4645vendor-advisory
• lists.fedoraproject.orgFEDORA-2020-7fd051b378https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWANFIR3PYAL5RJQ4AO3ZS2DYMSF2ZGZ/vendor-advisory
• lists.fedoraproject.orgFEDORA-2020-17149a4f3dhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DDNOAGIX5D77TTHT6YPMVJ5WTXTCQEI/vendor-advisory
• lists.opensuse.orgopenSUSE-SU-2020:0389http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00037.htmlvendor-advisory
• lists.fedoraproject.orgFEDORA-2020-39e0b8bd14https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/vendor-advisory
• usn.ubuntu.comUSN-4328-1https://usn.ubuntu.com/4328-1/vendor-advisory
• usn.ubuntu.comUSN-4335-1https://usn.ubuntu.com/4335-1/vendor-advisory
• support.apple.comhttps://support.apple.com/kb/HT211175
• support.apple.comhttps://support.apple.com/kb/HT211171
• support.apple.comhttps://support.apple.com/kb/HT211168
• support.apple.comhttps://support.apple.com/kb/HT211177
• seclists.org20200529 APPLE-SA-2020-05-26-1 iOS 13.5 and iPadOS 13.5http://seclists.org/fulldisclosure/2020/May/49mailing-list
• seclists.org20200529 APPLE-SA-2020-05-26-7 Safari 13.1.1http://seclists.org/fulldisclosure/2020/May/52mailing-list
• seclists.org20200529 APPLE-SA-2020-05-26-5 watchOS 6.2.5http://seclists.org/fulldisclosure/2020/May/55mailing-list
• seclists.org20200529 APPLE-SA-2020-05-26-4 tvOS 13.4.5http://seclists.org/fulldisclosure/2020/May/59mailing-list
• support.apple.comhttps://support.apple.com/HT211168
• support.apple.comhttps://support.apple.com/HT211171
• support.apple.comhttps://support.apple.com/HT211175
• support.apple.comhttps://support.apple.com/HT211177
• lists.debian.org[debian-lts-announce] 20230706 [SECURITY] [DLA 3481-1] libusrsctp security updatehttps://lists.debian.org/debian-lts-announce/2023/07/msg00003.htmlmailing-list