CVE-2018-0500: Buffer Overflow
curl versions 7.54.1 through 7.60.0 are vulnerable to a heap-based buffer overflow in the Curlsmtpescapeeob() function when uploading data over SMTP and using a reduced read buffer. An attacker could exploit this by convincing a user to use curl to upload data over SMTP with a reduced buffer to cause a crash or corrupt memory.
Other sources
Curlsmtpescapeeob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPTBUFFERSIZE value).
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.74.0-1.3+deb11u13Fixed in 7.74.0-1.3+deb11u16Fixed in 7.88.1-10+deb12u14Fixed in 7.88.1-10+deb12u5Fixed in 8.14.1-2+deb13u2Fixed in 8.18.0-2Fixed in 8.19.0~rc2-1 - Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 7.61.0 - Upgrade
Upgrade
curlto a version that resolves this vulnerability.Fixed in 7.60.0 - Upgrade
Upgrade
curlto a version that resolves this vulnerability.Fixed in 7.54.1 - Compensating control
Avoid using a reduced read buffer when uploading data over SMTP with curl; do not use a nonstandard --limit-rate argument and do not set CURLOPT_BUFFERSIZE to a reduced value.
Event History
Frequently Asked Questions
What is the severity of CVE-2018-0500?
CVE-2018-0500 is classified as a medium severity vulnerability due to the potential for exploitation via a heap-based buffer overflow.
How do I fix CVE-2018-0500?
To fix CVE-2018-0500, update curl to version 7.61.0 or later for Red Hat or version 7.74.0-1.3+deb11u13 or later for Debian.
Which versions of curl are affected by CVE-2018-0500?
CVE-2018-0500 affects curl versions from 7.54.1 up to 7.60.0 inclusive.
What types of attacks can exploit CVE-2018-0500?
An attacker could exploit CVE-2018-0500 by convincing a victim to upload data over SMTP using a vulnerable version of curl with a reduced read buffer.
Is there a specific requirement for exploiting CVE-2018-0500?
Exploitation of CVE-2018-0500 requires the victim to use curl with a reduced read buffer while uploading data over an SMTP server.