CVE-2015-3237
published 2015-06-22CVE-2015-3237: The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a…
PriorityP433medium6.4CVSS 2.0
AVNACLAuNCPINAP
EPSS
9.33%
94.9th percentile
The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | curl | < curl 7.43.0-1 (bookworm) | curl 7.43.0-1 (bookworm) |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | >= 0 < 7.43.0-1 | 7.43.0-1 |
| haxx | curl | >= 0 < 7.43.0-1 | 7.43.0-1 |
| haxx | curl | >= 0 < 7.43.0-1 | 7.43.0-1 |
| haxx | curl | >= 0 < 7.43.0-1 | 7.43.0-1 |
| haxx | libcurl | — | — |
| haxx | libcurl | — | — |
| haxx | libcurl | — | — |
| haxx | libcurl | — | — |
| hp | system_management_homepage | <= 7.5.3.1 | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | glassfish_server | — | — |
| oracle | glassfish_server | — | — |
CVSS provenance
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
osv6.4MEDIUM
vendor_debian6.4MEDIUM
vendor_redhat6.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
curl: SMB send off unrelated memory contents
vendor_redhat·2015-06-17·CVSS 6.4
CVE-2015-3237 [MEDIUM] CWE-201 curl: SMB send off unrelated memory contents
curl: SMB send off unrelated memory contents
The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.
Statement: This issue did not affect the versions of curl as shipped with Red Hat Enterprise Linux 5, 6, and 7, as they did not include support for SMB/CIFS.
Package: curl (Red Hat Ceph Storage 1.1) - Not affected
Package: curl (Red Hat Ceph Storage 1.2) - Not affected
Package: curl (Red Hat Enterprise Linux 5) - Not affected
Package: curl (Red Hat Enterprise Linux 6) - Not affected
Package: curl (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2015-3237: curl - The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows ...
vendor_debian·2015·CVSS 6.4
CVE-2015-3237 [MEDIUM] CVE-2015-3237: curl - The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows ...
The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.
Scope: local
bookworm: resolved (fixed in 7.43.0-1)
bullseye: resolved (fixed in 7.43.0-1)
forky: resolved (fixed in 7.43.0-1)
sid: resolved (fixed in 7.43.0-1)
trixie: resolved (fixed in 7.43.0-1)
GHSA
GHSA-c5fx-333r-cgw4: The smb_request_state function in cURL and libcurl 7
ghsa_unreviewed·2022-05-14
CVE-2015-3237 [MEDIUM] CWE-20 GHSA-c5fx-333r-cgw4: The smb_request_state function in cURL and libcurl 7
The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.
OSV
CVE-2015-3237: The smb_request_state function in cURL and libcurl 7
osv·2015-06-22·CVSS 6.4
CVE-2015-3237 [MEDIUM] CVE-2015-3237: The smb_request_state function in cURL and libcurl 7
The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.
No detection rules found.
No public exploits indexed.
HackerOne
SSRF in https://imgur.com/vidgif/url
hackerone·2016-03-12
SSRF in https://imgur.com/vidgif/url
SSRF in https://imgur.com/vidgif/url
Hello,
Short description
https://imgur.com/vidgif/url endpoint is vulnerable to a SSRF vulnerability which allows an attacker to craft connections originating from imgur servers to any destination on the internet and imgur internal network and craft outgoing UDP-packets / telnet-based protocol sessions (for example, to connect to SMTP servers from imgur and send spam).
Why does the vulnerability exist?
imgur allows users to use 'video-to-gif' service. When a user requests conversion of such a video, imgur's servers perform an HTTP request to a user-supplied URL in order to discover the URL-s content-type and length. It is evident that in order to do so imgur utilizes libcurl. However, imgur does not properly validate user input and does not configu
Bugzilla
CVE-2015-3237 curl: SMB send off unrelated memory contents
bugzilla·2015-06-19·CVSS 6.4
CVE-2015-3237 [MEDIUM] CVE-2015-3237 curl: SMB send off unrelated memory contents
CVE-2015-3237 curl: SMB send off unrelated memory contents
http://curl.haxx.se/docs/adv_20150617B.html
SMB send off unrelated memory contents
Project cURL Security Advisory, June 17th 2015 - Permalink
VULNERABILITY
libcurl can get tricked by a malicious SMB server to send off data it did not intend to.
In libcurl's state machine function handling the SMB protocol (smb_request_state()), two length and offset values are extracted from data that has arrived over the network, and those values are subsequently used to figure out what data range to send back.
The values are used and trusted without boundary checks and are just assumed to be valid. This allows carefully handicrafted packages to trick libcurl into responding and sending off data that was not intended. Or just crash if the va
Bugzilla
CVE-2015-3237 CVE-2015-3236 curl: various flaws [fedora-all]
bugzilla·2015-06-19·CVSS 5.0
CVE-2015-3237 [MEDIUM] CVE-2015-3237 CVE-2015-3236 curl: various flaws [fedora-all]
CVE-2015-3237 CVE-2015-3236 curl: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While onl
http://curl.haxx.se/docs/adv_20150617B.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/160660.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.securityfocus.com/bid/75387http://www.securityfocus.com/bid/91787http://www.securitytracker.com/id/1036371https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380https://security.gentoo.org/glsa/201509-02http://curl.haxx.se/docs/adv_20150617B.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/160660.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.securityfocus.com/bid/75387http://www.securityfocus.com/bid/91787http://www.securitytracker.com/id/1036371https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380https://security.gentoo.org/glsa/201509-02
2015-06-22
Published