Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-3237

The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.

Published

2015-06-22T19:59:04.653

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 6.4 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

4.9

Weaknesses
  • Type: Primary
    CWE-20
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application haxx curl 7.40.0 Yes
Application haxx curl 7.41.0 Yes
Application haxx curl 7.42.0 Yes
Application haxx curl 7.42.1 Yes
Application haxx libcurl 7.40.0 Yes
Application haxx libcurl 7.41.0 Yes
Application haxx libcurl 7.42.0 Yes
Application haxx libcurl 7.42.1 Yes
Application hp system_management_homepage ≤ 7.5.3.1 Yes
Application oracle enterprise_manager_ops_center 12.1.4 Yes
Application oracle enterprise_manager_ops_center 12.2.2 Yes
Application oracle enterprise_manager_ops_center 12.3.2 Yes
Application oracle glassfish_server 3.0.1 Yes
Application oracle glassfish_server 3.1.2 Yes
References