haxx libcurl CVE-2019-3823 vulnerability in Haxx and Other Products
Published on February 6, 2019

product logo product logo product logo product logo product logo
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Weakness Type

Out-of-bounds Read

The software reads data past the end, or before the beginning, of the intended buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. A crash can occur when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string. The expected sentinel might not be located in the out-of-bounds memory, causing excessive data to be read, leading to a segmentation fault or a buffer overflow. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent read operation then produces undefined or unexpected results.


Products Associated with CVE-2019-3823

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2019-3823 are published in these products:

Haxx Libcurl
 
Oracle Communications Operations Monitor
 
Oracle Http Server
 
Oracle Secure Global Desktop
 
Canonical Ubuntu Linux
 
Debian Linux
 
NetApp Clustered Data Ontap
 

Affected Versions

The curl Project curl Version 7.64.0 is affected by CVE-2019-3823

Exploit Probability

EPSS
1.67%
Percentile
81.94%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.