CVE-2019-3823
Medium
Description
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Haxx Libcurl
PublishedFeb 6, 2019
First seenFeb 6, 2019
Weakness typeCWE-125Out-of-bounds read
How to fix
Update
- haxx libcurl7.64.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| haxx libcurl | 7.34.0 ≤ v < 7.64.0 | 7.64.0 |
| canonical ubuntu_linux | 14.04, 16.04, 18.04, 18.10 | — |
| debian debian_linux | 9.0 | — |
| netapp clustered_data_ontap | No range specified | — |
| oracle communications_operations_monitor | 3.4, 4.0 | — |
| oracle http_server | 12.2.1.3.0 | — |
| oracle secure_global_desktop | 5.4 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.