{"id":"CVE-2019-3822","aliases":["ALPINE-CVE-2019-3822","BELL-CVE-2019-3822","CURL-CVE-2019-3822","DEBIAN-CVE-2019-3822","DLA-1672-1","DSA-4386-1","EUVD-2019-13445","GHSA-8wr2-mqj7-7vxp","RHSA-2019:3701","SUSE-SU-2019:0248-1","SUSE-SU-2019:0249-1","SUSE-SU-2019:0249-2","SUSE-SU-2019:0339-1","UBUNTU-CVE-2019-3822","USN-3882-1","openSUSE-SU-2019:0174-1","openSUSE-SU-2024:10582-1"],"status":"published","title":"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow....","description":"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.","severity":{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.12873,"percentile":0.96327,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121","CWE-787"],"published":"2019-02-06T00:00:00Z","modified":"2026-10-25T01:04:52Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"curl","fixed_in":["7.64.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"curl","fixed_in":["7.64.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"curl","fixed_in":["7.64.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"curl","fixed_in":["7.64.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"curl","fixed_in":["7.64.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["7.64.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["7.64.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.64.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["7.64.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["7.64.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["7.64.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["7.64.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["7.64.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["7.64.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["7.64.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"curl","fixed_in":["7.61.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"curl","fixed_in":["7.61.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"curl","fixed_in":["7.61.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"curl","fixed_in":["7.64.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.64.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.64.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.64.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"curl","fixed_in":["7.47.0-1ubuntu2.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"curl","fixed_in":["7.58.0-2ubuntu3.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.38.0-4+deb8u14"}]}],"versions":["7.38.0-4","7.38.0-4+deb8u1","7.38.0-4+deb8u10","7.38.0-4+deb8u11","7.38.0-4+deb8u12","7.38.0-4+deb8u13","7.38.0-4+deb8u2","7.38.0-4+deb8u3","7.38.0-4+deb8u4","7.38.0-4+deb8u5","7.38.0-4+deb8u6","7.38.0-4+deb8u7","7.38.0-4+deb8u8","7.38.0-4+deb8u9"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-5+deb9u9"}]}],"versions":["7.52.1-5","7.52.1-5+deb9u1","7.52.1-5+deb9u2","7.52.1-5+deb9u3","7.52.1-5+deb9u4","7.52.1-5+deb9u5","7.52.1-5+deb9u6","7.52.1-5+deb9u7","7.52.1-5+deb9u8"],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.12"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.6"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.12"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.6"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-lp150.2.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-lp150.2.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-1.1"}]}],"bundled":48}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"curl","product":"curl"},{"vendor":"debian","product":"debian_linux"},{"vendor":"haxx","product":"libcurl"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"oncommand_insight"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"netapp","product":"snapcenter"},{"vendor":"oracle","product":"communications_operations_monitor"},{"vendor":"oracle","product":"enterprise_manager_ops_center"},{"vendor":"oracle","product":"http_server"},{"vendor":"oracle","product":"mysql_server"},{"vendor":"oracle","product":"secure_global_desktop"},{"vendor":"oracle","product":"services_tools_bundle"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"siemens","product":"sinema_remote_connect_client"},{"vendor":"the curl project","product":"curl"}],"references":[{"url":"https://security.gentoo.org/glsa/201903-03","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://www.debian.org/security/2019/dsa-4386","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://curl.haxx.se/docs/CVE-2019-3822.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","article","report"]},{"url":"https://security.netapp.com/advisory/ntap-20190315-0001/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://usn.ubuntu.com/3882-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/106950","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20190719-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.f5.com/csp/article/K84141449","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.f5.com/csp/article/K84141449?utm_source=f5support\u0026amp%3Butm_medium=RSS","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3701","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3822","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f@%3Cdevnull.infra.apache.org%3E"},{"url":"https://support.f5.com/csp/article/K84141449?utm_source=f5support\u0026amp;utm_medium=RSS"},{"url":"https://github.com/advisories/GHSA-8wr2-mqj7-7vxp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-3822","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-3822","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-3822","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1662705","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670256","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3701.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-16890","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16890","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16890","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/CVE-2018-16890.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20483","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20483","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20483","tags":["advisory"]},{"url":"http://git.savannah.gnu.org/cgit/wget.git/tree/NEWS","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3822","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3822","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3823","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3823","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/CVE-2019-3823.html","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190248-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1123371","tags":["report"]},{"url":"https://bugzilla.suse.com/1123377","tags":["report"]},{"url":"https://bugzilla.suse.com/1123378","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3823","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190249-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190249-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190339-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1112758","tags":["report"]},{"url":"https://bugzilla.suse.com/1113029","tags":["report"]},{"url":"https://bugzilla.suse.com/1113660","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16842","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-3822","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3882-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-16890","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-3823","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DRDOZ4FJSPSJNNQSD2FOPKFCVGMYT4J2/#DRDOZ4FJSPSJNNQSD2FOPKFCVGMYT4J2","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22947","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-3822","description":"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.","status":"published","published":"2019-02-06T20:00:00Z","modified":"2026-04-15T20:52:52.914Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-13445","description":"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.","status":"published","published":"2019-02-06T20:00:00Z","modified":"2026-04-15T20:52:52Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:24.796113Z"}],"ghsa":[{"id":"GHSA-8wr2-mqj7-7vxp","title":"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow....","description":"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.","status":"published","published":"2022-05-13T01:09:33Z","modified":"2023-02-01T05:03:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:50:03.389119Z"}],"nvd":[{"id":"CVE-2019-3822","description":"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.","status":"published","published":"2019-02-06T20:29:00.353Z","modified":"2026-06-17T02:35:39.603Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:05:04.689371Z"}],"osv":[{"id":"ALPINE-CVE-2019-3822","description":"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.","status":"published","published":"2019-02-06T20:29:00.353Z","modified":"2026-09-21T06:17:52.516625386Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-3822","title":"CVE-2019-3822 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:22.405406Z","modified":"2026-01-26T09:48:59.954704Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-3822","description":"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.","status":"published","published":"2019-02-06T20:29:00.353Z","modified":"2026-10-24T10:30:56.91362041Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-3822","description":"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.","status":"published","published":"2019-02-06T20:29:00.353Z","modified":"2026-09-21T07:03:18.384036223Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"RHSA-2019:3701","title":"Red Hat Security Advisory: curl security and bug fix update","status":"published","published":"2024-09-16T02:32:05Z","modified":"2026-09-21T10:02:23Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2019-3822","description":"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.","status":"published","published":"2019-02-06T00:00:00Z","modified":"2026-04-22T11:57:18.599119Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"CURL-CVE-2019-3822","title":"NTLMv2 type-3 header stack buffer overflow","description":"libcurl contains a stack based buffer overflow vulnerability.\n\nThe function creating an outgoing NTLM type-3 header\n(`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the\nrequest HTTP header contents based on previously received data. The check that\nexists to prevent the local buffer from getting overflowed is implemented\nwrongly (using unsigned math) and as such it does not prevent the overflow\nfrom happening.\n\nThis output data can grow larger than the local buffer if large response data\nis extracted from a previous NTLMv2 header provided by the malicious or broken\nHTTP server.\n\nSuch large response data needs to be around 1000 bytes or more. The actual\npayload data copied to the target buffer comes from the NTLMv2 type-2 response\nheader.","status":"published","published":"2019-02-06T08:00:00Z","modified":"2026-10-25T01:04:52.831190187Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"DLA-1672-1","title":"curl - security update","status":"published","published":"2019-02-11T00:00:00Z","modified":"2026-03-09T01:17:52.02774Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4386-1","title":"curl - security update","status":"published","published":"2019-02-06T00:00:00Z","modified":"2026-03-09T02:11:00.60977Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"openSUSE-SU-2019:0174-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-3823: Fixed a heap out-of-bounds read in the code handling the end-of-response for SMTP (bsc#1123378).\n- CVE-2019-3822: Fixed a stack based buffer overflow in the function creating an outgoing NTLM type-3 message (bsc#1123377).\n- CVE-2018-16890: Fixed a heap buffer out-of-bounds read in the function handling incoming NTLM type-2 messages (bsc#1123371).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T10:58:25Z","modified":"2026-02-04T03:48:17.430729Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10582-1","title":"curl-7.79.1-1.1 on GA media","description":"These are all security issues fixed in the curl-7.79.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:40:36.472951Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:0248-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-3823: Fixed a heap out-of-bounds read in the code handling the end-of-response for SMTP (bsc#1123378).\n- CVE-2019-3822: Fixed a stack based buffer overflow in the function creating an outgoing NTLM type-3 message (bsc#1123377).\n- CVE-2018-16890: Fixed a heap buffer out-of-bounds read in the function handling incoming NTLM type-2 messages (bsc#1123371).\n","status":"published","published":"2019-02-06T07:35:24Z","modified":"2026-02-04T02:13:28.642078Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0249-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-3823: Fixed a heap out-of-bounds read in the code handling the end-of-response for SMTP (bsc#1123378).\n- CVE-2019-3822: Fixed a stack based buffer overflow in the function creating an outgoing NTLM type-3 message (bsc#1123377).\n- CVE-2018-16890: Fixed a heap buffer out-of-bounds read in the function handling incoming NTLM type-2 messages (bsc#1123371).\n","status":"published","published":"2019-02-06T07:36:48Z","modified":"2026-02-04T04:24:45.022987Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0249-2","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-3823: Fixed a heap out-of-bounds read in the code handling the end-of-response for SMTP (bsc#1123378).\n- CVE-2019-3822: Fixed a stack based buffer overflow in the function creating an outgoing NTLM type-3 message (bsc#1123377).\n- CVE-2018-16890: Fixed a heap buffer out-of-bounds read in the function handling incoming NTLM type-2 messages (bsc#1123371).\n","status":"published","published":"2019-04-12T06:24:04Z","modified":"2026-02-04T03:30:08.523525Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0339-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-3822: Fixed a NTLMv2 type-3 header stack buffer overflow (bsc#1123377).\n- CVE-2019-3823: Fixed an out-of-bounds read in the SMTP end-of-response (bsc#1123378).\n- CVE-2018-16890: Fixed an out-of-bounds buffer read in NTLM type2 (bsc#1123371). \n- CVE-2018-16842: Fixed an out-of-bounds read in tool_msgs.c (bsc#1113660).\n- CVE-2018-16840: Fixed a use-after-free in handle close  (bsc#1113029).\n- CVE-2018-16839: Fixed an SASL password overflow caused by an integer overflow (bsc#1112758).\n\n","status":"published","published":"2019-02-13T07:33:54Z","modified":"2026-02-04T03:49:52.261316Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3882-1","title":"curl vulnerabilities","description":"Wenxiang Qian discovered that curl incorrectly handled certain NTLM\nauthentication messages. A remote attacker could possibly use this issue to\ncause curl to crash, resulting in a denial of service. This issue only\napplied to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10.\n(CVE-2018-16890)\n\nWenxiang Qian discovered that curl incorrectly handled certain NTLMv2\nauthentication messages. A remote attacker could use this issue to cause\ncurl to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only applied to Ubuntu 16.04 LTS, Ubuntu 18.04\nLTS, and Ubuntu 18.10. (CVE-2019-3822)\n\nBrian Carpenter discovered that curl incorrectly handled certain SMTP\nresponses. A remote attacker could possibly use this issue to cause curl to\ncrash, resulting in a denial of service. (CVE-2019-3823)\n","status":"published","published":"2019-02-06T14:07:54Z","modified":"2026-04-22T09:19:17.811399Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}