CVEvulnerability

CVE-2015-3237

6.4 MEDIUM Published 2015-06-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2015-06-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:P
Weaknesses
CWE-20

Description

The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.

Affected configurations

• haxx curl 7.40.0 • haxx curl 7.41.0 • haxx curl 7.42.0 • haxx curl 7.42.1 • haxx libcurl 7.40.0 • haxx libcurl 7.41.0 • haxx libcurl 7.42.0 • haxx libcurl 7.42.1 • hp system management homepage (<= 7.5.3.1) • oracle enterprise manager ops center 12.1.4 • oracle enterprise manager ops center 12.2.2 • oracle enterprise manager ops center 12.3.2 • oracle glassfish server 3.0.1 • oracle glassfish server 3.1.2

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References