The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.
The MITRE CVE dictionary describes this issue as:
Find out more about CVE-2015-3237 from the MITRE CVE dictionary dictionary and NIST NVD.
This issue did not affect the versions of curl as shipped with Red Hat Enterprise Linux 5, 6, and 7, as they did not include support for SMB/CIFS.
NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.
| Base Score | 5.8 |
|---|---|
| Base Metrics | AV:N/AC:M/Au:N/C:P/I:N/A:P |
| Access Vector | Network |
| Access Complexity | Medium |
| Authentication | None |
| Confidentiality Impact | Partial |
| Integrity Impact | None |
| Availability Impact | Partial |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
| Platform | Package | State |
|---|---|---|
| Red Hat Enterprise Linux 7 | curl | Not affected |
| Red Hat Enterprise Linux 6 | curl | Not affected |
| Red Hat Enterprise Linux 5 | curl | Not affected |
| Red Hat Ceph Storage 1.2 | curl | Not affected |
| Red Hat Ceph Storage 1.1 | curl | Not affected |
Vulmon