libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Mar 7, 2019 | Feb 6, 2019 |
| Amazon Linux Ami 2 | — | Upgrade curlUpgrade libcurlUpgrade libcurl-develUpgrade curl-debuginfo | Apr 27, 2020 | Feb 6, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 6, 2019 |
| Centos_linux | — | Upgrade libcurl-minimalUpgrade libcurl-minimal-debuginfoUpgrade libcurlUpgrade libcurl-debuginfoUpgrade curl-debuginfoUpgrade curl-debugsourceUpgrade curl-minimal-debuginfoUpgrade libcurl-develUpgrade curl | Nov 6, 2019 | Feb 6, 2019 |
| Debian | — | Upgrade curl | Feb 7, 2019 | Feb 6, 2019 |
| Freebsd | — | Upgrade curl | Feb 8, 2019 | Feb 7, 2019 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Mar 11, 2019 | Feb 6, 2019 |
| Oracle Solaris | — | Upgrade web/curl to version 7.64.0-11.4.7.0.1.3.0 on Solaris 11.4 | Mar 20, 2019 | Feb 6, 2019 |
| Oracle_linux | — | Upgrade libcurl-develUpgrade curlUpgrade libcurlUpgrade libcurl-minimal | Oct 5, 2022 | Feb 6, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Feb 6, 2019 |
| Redhat_linux | — | Upgrade libcurl-develUpgrade libcurlUpgrade curlUpgrade curl-debuginfoUpgrade curl-debugsourceUpgrade libcurl-debuginfoUpgrade curl-minimal-debuginfoUpgrade libcurl-minimalUpgrade libcurl-minimal-debuginfo | Nov 6, 2019 | Feb 6, 2019 |
| Suse | — | Upgrade libcurl-develUpgrade libcurl-mini-develUpgrade curl-miniUpgrade libcurl4Upgrade curlUpgrade libcurl4-miniUpgrade libcurl4-32bitUpgrade libcurl-devel-32bit | Feb 7, 2019 | Feb 6, 2019 |
| Ubuntu | — | Upgrade libcurl3Upgrade libcurl3-nssUpgrade curlUpgrade libcurl3-gnutlsUpgrade libcurl4 | Feb 14, 2019 | Feb 6, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 6, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub