libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Mar 7, 2019 | Feb 6, 2019 |
| Amazon Linux Ami 2 | — | Upgrade libcurl-develUpgrade curlUpgrade curl-debuginfoUpgrade libcurl | Apr 27, 2020 | Feb 6, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 6, 2019 |
| Centos_linux | — | Upgrade libcurl-minimalUpgrade libcurl-minimal-debuginfoUpgrade curl-debugsourceUpgrade libcurl-develUpgrade curl-debuginfoUpgrade curlUpgrade libcurl-debuginfoUpgrade curl-minimal-debuginfoUpgrade libcurl | Nov 6, 2019 | Feb 6, 2019 |
| Debian | — | Upgrade curl | Feb 7, 2019 | Feb 6, 2019 |
| Freebsd | — | Upgrade curl | Feb 8, 2019 | Feb 7, 2019 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Mar 11, 2019 | Feb 6, 2019 |
| Oracle Solaris | — | Upgrade web/curl to version 7.64.0-11.4.7.0.1.3.0 on Solaris 11.4 | Mar 20, 2019 | Feb 6, 2019 |
| Oracle_linux | — | Upgrade libcurlUpgrade curlUpgrade libcurl-develUpgrade libcurl-minimal | Oct 5, 2022 | Feb 6, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Feb 6, 2019 |
| Redhat_linux | — | Upgrade libcurl-debuginfoUpgrade curlUpgrade curl-debugsourceUpgrade libcurlUpgrade libcurl-develUpgrade curl-debuginfoUpgrade libcurl-minimalUpgrade libcurl-minimal-debuginfoUpgrade curl-minimal-debuginfo | Nov 6, 2019 | Feb 6, 2019 |
| Suse | — | Upgrade libcurl4-miniUpgrade libcurl4-32bitUpgrade libcurl-devel-32bitUpgrade libcurl-mini-develUpgrade libcurl4Upgrade curl-miniUpgrade libcurl-develUpgrade curl | Feb 7, 2019 | Feb 6, 2019 |
| Ubuntu | — | Upgrade curlUpgrade libcurl4Upgrade libcurl3-gnutlsUpgrade libcurl3-nssUpgrade libcurl3 | Feb 14, 2019 | Feb 6, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 6, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub