CVE-2015-3237: Input Validation
The smbrequeststate function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3237?
CVE-2015-3237 has been classified as a medium severity vulnerability due to its potential for information leakage and denial of service.
How do I fix CVE-2015-3237?
To fix CVE-2015-3237, upgrade cURL and libcurl to version 7.43.0 or later.
What are the potential impacts of CVE-2015-3237?
The potential impacts of CVE-2015-3237 include unauthorized access to sensitive information and possible application crashes.
Which versions of cURL and libcurl are affected by CVE-2015-3237?
CVE-2015-3237 affects cURL and libcurl versions 7.40.0 through 7.42.1.
Is there any workaround for CVE-2015-3237 if I cannot update?
There are no effective workarounds for CVE-2015-3237; updating to a secure version is the only recommended approach.