CVE-2015-3237

2015-06-2219:59:00

CWE-20

[email protected]

web.nvd.nist.gov

curl

libcurl

cve-2015-3237

smb servers

remote exploitation

out-of-bounds read

denial of service

memory disclosure

8.9 High

AI Score

Confidence

High

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

0.011 Low

EPSS

Percentile

84.4%

JSON

The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.

CPENameOperatorVersion
haxx:curlhaxx curleq7.40.0
haxx:libcurlhaxx libcurleq7.40.0
haxx:curlhaxx curleq7.42.0
haxx:libcurlhaxx libcurleq7.42.1
haxx:libcurlhaxx libcurleq7.41.0
haxx:curlhaxx curleq7.42.1
haxx:curlhaxx curleq7.41.0
haxx:libcurlhaxx libcurleq7.42.0
hp:system_management_homepagehp system management homepagele7.5.3.1
oracle:enterprise_manager_ops_centeroracle enterprise manager ops centereq12.2.2

CPE	Name	Operator	Version
haxx:curl	haxx curl	eq	7.40.0
haxx:libcurl	haxx libcurl	eq	7.40.0
haxx:curl	haxx curl	eq	7.42.0
haxx:libcurl	haxx libcurl	eq	7.42.1
haxx:libcurl	haxx libcurl	eq	7.41.0
haxx:curl	haxx curl	eq	7.42.1
haxx:curl	haxx curl	eq	7.41.0
haxx:libcurl	haxx libcurl	eq	7.42.0
hp:system_management_homepage	hp system management homepage	le	7.5.3.1
oracle:enterprise_manager_ops_center	oracle enterprise manager ops center	eq	12.2.2