{"id":"CVE-2013-0249","aliases":["CURL-CVE-2013-0249","DEBIAN-CVE-2013-0249","EUVD-2013-0280","GHSA-mj69-wpmp-9c9f","openSUSE-SU-2024:10303-1"],"status":"published","title":"Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl...","description":"Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.21643,"percentile":0.97646,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-119"],"published":"2013-02-06T08:00:00Z","modified":"2026-10-25T01:04:46Z","exploits":[{"source":"exploitdb","id":"EDB-24487","title":"cURL - Buffer Overflow (PoC)","type":"dos","platform":"linux","date":"2013-02-11","url":"https://www.exploit-db.com/exploits/24487"}],"fixes":[{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.29.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.29.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.29.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29.0-1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.51.0-1.1"}]}],"bundled":32}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"haxx","product":"curl"},{"vendor":"haxx","product":"libcurl"}],"references":[{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/120170/Slackware-Security-Advisory-curl-Updates.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/57842","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://www.exploit-db.com/exploits/24487","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","evidence"]},{"url":"http://www.ubuntu.com/usn/USN-1721-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-February/099140.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1028093","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.osvdb.org/89988","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/120147/cURL-Buffer-Overflow.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://blog.volema.com/curl-rce.html","tags":["x_refsource_MISC","x_transferred","article"]},{"url":"http://curl.haxx.se/docs/adv_20130206.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://nakedsecurity.sophos.com/2013/02/10/anatomy-of-a-vulnerability-curl-web-download-toolkit-holed-by-authentication-bug/","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0249"},{"url":"http://nakedsecurity.sophos.com/2013/02/10/anatomy-of-a-vulnerability-curl-web-download-toolkit-holed-by-authentication-bug"},{"url":"https://github.com/advisories/GHSA-mj69-wpmp-9c9f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-0249","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8625","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-0249","description":"Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.","status":"published","published":"2013-03-08T22:00:00Z","modified":"2024-08-06T14:18:09.56Z","updated_at":"2026-11-02T14:34:59.222149Z"}],"euvd":[{"id":"EUVD-2013-0280","description":"Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.","status":"published","published":"2013-03-08T22:00:00Z","modified":"2024-08-06T14:18:09Z","updated_at":"2026-11-03T01:56:45.704567Z"}],"ghsa":[{"id":"GHSA-mj69-wpmp-9c9f","title":"Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl...","description":"Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.","status":"published","published":"2022-05-05T02:48:41Z","modified":"2025-04-11T04:09:14Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:13.537017Z"}],"nvd":[{"id":"CVE-2013-0249","description":"Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.","status":"published","published":"2013-03-08T22:55:01.123Z","modified":"2026-06-16T23:49:03.187Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:24.091325Z"}],"osv":[{"id":"CURL-CVE-2013-0249","title":"SASL buffer overflow","description":"libcurl is vulnerable to a buffer overflow vulnerability when communicating\n  with one of the protocols POP3, SMTP or IMAP.\n\n  When negotiating SASL DIGEST-MD5 authentication, the function\n  `Curl_sasl_create_digest_md5_message()` uses the data provided from the\n  server without doing the proper length checks and that data is then appended\n  to a local fixed-size buffer on the stack.\n\n  This vulnerability can be exploited by someone who is in control of a server\n  that a libcurl based program is accessing with POP3, SMTP or IMAP. For\n  applications that accept user provided URLs, it is also thinkable that a\n  malicious user would feed an application with a URL to a server hosting code\n  targeting this flaw.\n\n  This vulnerability can be used for remote code execution (RCE) on vulnerable\n  systems.\n\n  Both curl the command line tool and applications using the libcurl library\n  are vulnerable.","status":"published","published":"2013-02-06T08:00:00Z","modified":"2026-10-25T01:04:46.908556906Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CVE-2013-0249","description":"Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.","status":"published","published":"2013-03-08T22:55:01Z","modified":"2026-04-10T03:42:41.54485Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-0249","description":"Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.","status":"published","published":"2013-03-08T22:55:01.123Z","modified":"2026-09-01T20:03:11.456052107Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"openSUSE-SU-2024:10303-1","title":"curl-7.51.0-1.1 on GA media","description":"These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:23.860668Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}