libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Mar 7, 2019 | Feb 6, 2019 |
| Amazon Linux Ami 2 | — | Upgrade curl-debuginfoUpgrade libcurlUpgrade libcurl-develUpgrade curl | Apr 27, 2020 | Feb 6, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 6, 2019 |
| Centos_linux | — | Upgrade libcurl-minimalUpgrade libcurl-minimal-debuginfoUpgrade libcurl-develUpgrade curlUpgrade libcurl-debuginfoUpgrade curl-minimal-debuginfoUpgrade libcurlUpgrade curl-debugsourceUpgrade curl-debuginfo | Nov 6, 2019 | Feb 6, 2019 |
| Debian | — | Upgrade curl | Feb 7, 2019 | Feb 6, 2019 |
| Freebsd | — | Upgrade curl | Feb 8, 2019 | Feb 7, 2019 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Mar 11, 2019 | Feb 6, 2019 |
| Oracle Solaris | — | Upgrade web/curl to version 7.64.0-11.4.7.0.1.3.0 on Solaris 11.4 | Mar 20, 2019 | Feb 6, 2019 |
| Oracle_linux | — | Upgrade libcurlUpgrade curlUpgrade libcurl-develUpgrade libcurl-minimal | Oct 5, 2022 | Feb 6, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Feb 6, 2019 |
| Redhat_linux | — | Upgrade curl-minimal-debuginfoUpgrade libcurl-minimal-debuginfoUpgrade libcurl-minimalUpgrade libcurl-debuginfoUpgrade curl-debugsourceUpgrade curl-debuginfoUpgrade curlUpgrade libcurl-develUpgrade libcurl | Nov 6, 2019 | Feb 6, 2019 |
| Suse | — | Upgrade libcurl4-32bitUpgrade libcurl4-miniUpgrade libcurl-devel-32bitUpgrade libcurl4Upgrade libcurl-mini-develUpgrade curl-miniUpgrade libcurl-develUpgrade curl | Feb 7, 2019 | Feb 6, 2019 |
| Ubuntu | — | Upgrade libcurl3-nssUpgrade libcurl3Upgrade libcurl3-gnutlsUpgrade libcurl4Upgrade curl | Feb 14, 2019 | Feb 6, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 6, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub