libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Mar 7, 2019 | Feb 6, 2019 |
| Amazon Linux Ami 2 | — | Upgrade curl-debuginfoUpgrade libcurlUpgrade libcurl-develUpgrade curl | Apr 27, 2020 | Feb 6, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 6, 2019 |
| Centos_linux | — | Upgrade libcurl-debuginfoUpgrade curlUpgrade curl-debuginfoUpgrade libcurl-develUpgrade curl-debugsourceUpgrade libcurlUpgrade curl-minimal-debuginfoUpgrade libcurl-minimal-debuginfoUpgrade libcurl-minimal | Nov 6, 2019 | Feb 6, 2019 |
| Debian | — | Upgrade curl | Feb 7, 2019 | Feb 6, 2019 |
| Freebsd | — | Upgrade curl | Feb 8, 2019 | Feb 7, 2019 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Mar 11, 2019 | Feb 6, 2019 |
| Oracle Solaris | — | Upgrade web/curl to version 7.64.0-11.4.7.0.1.3.0 on Solaris 11.4 | Mar 20, 2019 | Feb 6, 2019 |
| Oracle_linux | — | Upgrade libcurl-minimalUpgrade libcurlUpgrade curlUpgrade libcurl-devel | Oct 5, 2022 | Feb 6, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Feb 6, 2019 |
| Redhat_linux | — | Upgrade libcurl-minimal-debuginfoUpgrade libcurl-minimalUpgrade curl-minimal-debuginfoUpgrade curlUpgrade libcurl-develUpgrade curl-debuginfoUpgrade curl-debugsourceUpgrade libcurlUpgrade libcurl-debuginfo | Nov 6, 2019 | Feb 6, 2019 |
| Suse | — | Upgrade libcurl4-miniUpgrade libcurl4-32bitUpgrade libcurl-devel-32bitUpgrade curlUpgrade curl-miniUpgrade libcurl-develUpgrade libcurl4Upgrade libcurl-mini-devel | Feb 7, 2019 | Feb 6, 2019 |
| Ubuntu | — | Upgrade libcurl3-nssUpgrade libcurl3Upgrade curlUpgrade libcurl4Upgrade libcurl3-gnutls | Feb 14, 2019 | Feb 6, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 6, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub