CVE-2013-0249
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl...
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.
Exploit likelihood
What each source reports
NVD Score used
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.
- Record
CVE-2013-0249- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.
- Record
CVE-2013-0249- Updated
- 2026-11-02
EUVDEUVD-2013-0280 No score
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.
- Record
EUVD-2013-0280- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mj69-wpmp-9c9f No score
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl...
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.
- Record
GHSA-mj69-wpmp-9c9f- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVCURL-CVE-2013-0249 No score
SASL buffer overflow
libcurl is vulnerable to a buffer overflow vulnerability when communicating with one of the protocols POP3, SMTP or IMAP.
When negotiating SASL DIGEST-MD5 authentication, the function
Curl_sasl_create_digest_md5_message() uses the data provided from the
server without doing the proper length checks and that data is then appended
to a local fixed-size buffer on the stack.
This vulnerability can be exploited by someone who is in control of a server that a libcurl based program is accessing with POP3, SMTP or IMAP. For applications that accept user provided URLs, it is also thinkable that a malicious user would feed an application with a URL to a server hosting code targeting this flaw.
This vulnerability can be used for remote code execution (RCE) on vulnerable systems.
Both curl the command line tool and applications using the libcurl library are vulnerable.
- Record
CURL-CVE-2013-0249- Updated
- 2026-11-02
OSV No score
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.
- Record
CVE-2013-0249- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-0249 No score
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.
- Record
DEBIAN-CVE-2013-0249- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10303-1 No score
curl-7.51.0-1.1 on GA media
These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10303-1- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | cURL - Buffer Overflow (PoC) | 2013-02-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-0249 is a high vulnerability (CVSS 7.5) in Haxx Curl, published February 6, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 21.6%, the 97th percentile. Fixed in curl 7.29.0-1.
References
oracle.com/technetwork/topics/security/cpujul2015-2367936.html
packetstormsecurity.com/files/120170/Slackware-Security-Advisory-curl-Updates.html
securityfocus.com/bid/57842
lists.apple.com/archives/security-announce/2013/Oct/msg00004.html
exploit-db.com/exploits/24487
ubuntu.com/usn/USN-1721-1
Show 42 moreShow less
lists.fedoraproject.org/pipermail/package-announce/2013-February/099140.html
securitytracker.com/id/1028093
osvdb.org/89988
blog.volema.com/curl-rce.html
curl.haxx.se/docs/adv_20130206.html
nakedsecurity.sophos.com/2013/02/10/anatomy-of-a-vulnerability-curl-web-download-toolkit-holed-by-authentication-bug
nvd.nist.gov/vuln/detail/CVE-2013-0249
github.com/advisories/GHSA-mj69-wpmp-9c9f
security-tracker.debian.org/tracker/CVE-2013-0249
suse.com/security/cve/CVE-2009-0037