Vulnerability Details : CVE-2019-5544 Potential exploit Used for ransomware! Heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range

[100000BC]

Hey all,
We just got a notice from our IT department of this issue, and OpenSLP is an integral part of our data operations... Any idea if this can be fixed relatively quickly?

Vulnerability Details : CVE-2019-5544
Potential exploit
Used for ransomware!
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

https://www.cvedetails.com/cve/CVE-2019-5544/

[jcalcote]

Normal procedure is to create the fix for your own needs and submit a patch to the project. I am technically the maintainer but I no longer have time to actively work on the project. I will be happy to review and incorporate pull requests though. In my current job this is what I do for open source projects we use. John

…

On Tue, Apr 22, 2025 at 10:57 AM 100000BC ***@***.***> wrote: Hey all, We just got a notice from our IT department of this issue, and OpenSLP is an integral part of our data operations... Any idea if this can be fixed relatively quickly? Vulnerability Details : CVE-2019-5544 <https://www.cvedetails.com/cve/CVE-2019-5544/> Potential exploit Used for ransomware! OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. https://www.cvedetails.com/cve/CVE-2019-5544/ — Reply to this email directly, view it on GitHub <#16>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAMB4ROEL4PP74L2HUPOWL22ZYG5AVCNFSM6AAAAAB3UGXGRKVHI2DSMVQWIX3LMV43ASLTON2WKOZTGAYTCNRSGY3DAMQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***> *100000BC* created an issue (openslp-org/openslp#16) <#16> Hey all, We just got a notice from our IT department of this issue, and OpenSLP is an integral part of our data operations... Any idea if this can be fixed relatively quickly? Vulnerability Details : CVE-2019-5544 <https://www.cvedetails.com/cve/CVE-2019-5544/> Potential exploit Used for ransomware! OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. https://www.cvedetails.com/cve/CVE-2019-5544/ — Reply to this email directly, view it on GitHub <#16>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAMB4ROEL4PP74L2HUPOWL22ZYG5AVCNFSM6AAAAAB3UGXGRKVHI2DSMVQWIX3LMV43ASLTON2WKOZTGAYTCNRSGY3DAMQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[urbasus]

I followed the links and found the proposed patch here: https://www.openwall.com/lists/oss-security/2019/12/06/1

Doesn't seem like anyone made a pull request of it.