{"id":"CVE-2015-3237","aliases":["CURL-CVE-2015-3237","DEBIAN-CVE-2015-3237","EUVD-2015-3293","GHSA-c5fx-333r-cgw4","MGASA-2015-0263","openSUSE-SU-2024:10303-1"],"status":"published","title":"The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB...","description":"The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.","severity":{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.08302,"percentile":0.94963,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2015-06-17T08:00:00Z","modified":"2026-10-27T01:28:32Z","fixes":[{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.43.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.43.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.43.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.43.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.43.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.43.0-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.40.0-3.1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.51.0-1.1"}]}],"bundled":32}],"products":[{"vendor":"haxx","product":"curl"},{"vendor":"haxx","product":"libcurl"},{"vendor":"hp","product":"system_management_homepage"},{"vendor":"oracle","product":"enterprise_manager_ops_center"},{"vendor":"oracle","product":"glassfish_server"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160660.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://curl.haxx.se/docs/adv_20150617B.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.securitytracker.com/id/1036371","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/91787","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201509-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/75387","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3237"},{"url":"https://github.com/advisories/GHSA-c5fx-333r-cgw4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3237","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0263.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16140","tags":["report"]},{"url":"http://curl.haxx.se/docs/adv_20150617A.html","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8625","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-3237","description":"The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.","status":"published","published":"2015-06-22T19:00:00Z","modified":"2024-08-06T05:39:32.139Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3293","description":"The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.","status":"published","published":"2015-06-22T19:00:00Z","modified":"2024-08-06T05:39:32Z","updated_at":"2026-11-03T02:22:08.642556Z"}],"ghsa":[{"id":"GHSA-c5fx-333r-cgw4","title":"The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB...","description":"The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.","status":"published","published":"2022-05-14T02:21:22Z","modified":"2023-02-02T05:05:41Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:52:09.721765Z"}],"nvd":[{"id":"CVE-2015-3237","description":"The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.","status":"published","published":"2015-06-22T19:59:04.653Z","modified":"2026-06-17T00:25:35.833Z","cvss":[{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:05.884985Z"}],"osv":[{"id":"CURL-CVE-2015-3237","title":"SMB send off unrelated memory contents","description":"libcurl can get tricked by a malicious SMB server to send off data it did not\nintend to.\n\nIn libcurl's state machine function handling the SMB protocol\n(`smb_request_state()`), two length and offset values are extracted from data\nthat has arrived over the network, and those values are subsequently used to\nfigure out what data range to send back.\n\nThe values are used and trusted without boundary checks and are assumed to be\nvalid. This allows carefully handcrafted packages to trick libcurl into\nresponding and sending off data that was not intended. Or crash if the values\ncause libcurl to access invalid memory.","status":"published","published":"2015-06-17T08:00:00Z","modified":"2026-10-27T01:28:32.821325525Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CVE-2015-3237","description":"The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.","status":"published","published":"2015-06-22T19:59:04Z","modified":"2026-04-16T06:20:17.826025343Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3237","description":"The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.","status":"published","published":"2015-06-22T19:59:04.653Z","modified":"2026-09-09T06:47:27.053774168Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"MGASA-2015-0263","title":"Updated curl package fixes security vulnerability","description":"libcurl can wrongly send HTTP credentials when re-using connections. Even\nif the handle for an HTTP connection is reset, it retains the credentials,\nwhich can cause them to be unintentionally leaked in subsequent requests\n(CVE-2015-3236).\n\nlibcurl can get tricked by a malicious SMB server to send off data it did\nnot intend to. A malicious SMB server can use this to access arbitrary\nprocess memory, or to crash the client, causing a denial of service\n(CVE-2015-3237).\n","status":"published","published":"2015-07-05T17:22:03Z","modified":"2026-04-16T06:23:45.911162756Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10303-1","title":"curl-7.51.0-1.1 on GA media","description":"These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:23.860668Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}