libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Mar 7, 2019 | Feb 6, 2019 |
| Amazon Linux Ami 2 | — | Upgrade libcurlUpgrade libcurl-develUpgrade curlUpgrade curl-debuginfo | Apr 27, 2020 | Feb 6, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 6, 2019 |
| Centos_linux | — | Upgrade curlUpgrade curl-minimal-debuginfoUpgrade curl-debugsourceUpgrade libcurl-develUpgrade libcurlUpgrade curl-debuginfoUpgrade libcurl-debuginfoUpgrade libcurl-minimal-debuginfoUpgrade libcurl-minimal | Nov 6, 2019 | Feb 6, 2019 |
| Debian | — | Upgrade curl | Feb 7, 2019 | Feb 6, 2019 |
| Freebsd | — | Upgrade curl | Feb 8, 2019 | Feb 7, 2019 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Mar 11, 2019 | Feb 6, 2019 |
| Oracle Solaris | — | Upgrade web/curl to version 7.64.0-11.4.7.0.1.3.0 on Solaris 11.4 | Mar 20, 2019 | Feb 6, 2019 |
| Oracle_linux | — | Upgrade curlUpgrade libcurlUpgrade libcurl-develUpgrade libcurl-minimal | Oct 5, 2022 | Feb 6, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Feb 6, 2019 |
| Redhat_linux | — | Upgrade libcurl-minimalUpgrade libcurl-minimal-debuginfoUpgrade curl-minimal-debuginfoUpgrade libcurl-debuginfoUpgrade curl-debuginfoUpgrade libcurlUpgrade libcurl-develUpgrade curlUpgrade curl-debugsource | Nov 6, 2019 | Feb 6, 2019 |
| Suse | — | Upgrade libcurl-develUpgrade curl-miniUpgrade libcurl4Upgrade curlUpgrade libcurl-mini-develUpgrade libcurl4-miniUpgrade libcurl4-32bitUpgrade libcurl-devel-32bit | Feb 7, 2019 | Feb 6, 2019 |
| Ubuntu | — | Upgrade libcurl3-nssUpgrade libcurl3Upgrade libcurl4Upgrade curlUpgrade libcurl3-gnutls | Feb 14, 2019 | Feb 6, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 6, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub