Published: 22/06/2015 Updated: 17/10/2018

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

VMScore: 570

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P

The smb_request_state function in cURL and libcurl 7.40.0 up to and including 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.

Vulnerable Product	Search on Vulmon	Subscribe to Product
haxx libcurl 7.40.0
haxx libcurl 7.41.0
haxx curl 7.40.0
haxx curl 7.41.0
haxx curl 7.42.0
haxx curl 7.42.1
haxx libcurl 7.42.0
haxx libcurl 7.42.1
hp system management homepage
oracle glassfish server 3.1.2
oracle enterprise manager ops center 12.1.4
oracle enterprise manager ops center 12.2.2
oracle enterprise manager ops center 12.3.2
oracle glassfish server 3.0.1

As <a href="curlhaxxse/docs/adv_20150617Ahtml">discussed upstream</a>, libcurl can wrongly send HTTP credentials when re-using connections (CVE-2015-3236) Also <a href="curlhaxxse/docs/adv_20150617Bhtml">discussed upstream</a>, libcurl can get tricked by a malicious SMB server to send off data it did not ...

The smb_request_state function in cURL and libcurl 7400 through 7421 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values ...

CWE-20 http://curl.haxx.se/docs/adv_20150617B.html https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017 http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.securityfocus.com/bid/91787 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securityfocus.com/bid/75387 http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160660.html https://security.gentoo.org/glsa/201509-02 http://www.securitytracker.com/id/1036371 http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html https://nvd.nist.gov https://alas.aws.amazon.com/ALAS-2015-551.html https://access.redhat.com/security/cve/cve-2015-3237

CVE-2015-3237

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect