CVE-2018-0500
Description
Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value).
Risk Information
Base Score
9.8
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
1.151
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerability CVE-2018-0500 are affected in Curl For Windows 7.60.0 | Windows |
| Vulnerabilities CVE-2018-0500 are fixed in Curl For Windows 7.61.0 | Windows |
| HTTP, HTTPS, and FTP client and client libraries (USN-3710-1) curl_7.55.1-1ubuntu2.6_i386.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3710-1) curl_7.55.1-1ubuntu2.6_amd64.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3710-1) libcurl3_7.55.1-1ubuntu2.6_i386.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3710-1) libcurl3_7.55.1-1ubuntu2.6_amd64.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3710-1) libcurl3-nss_7.55.1-1ubuntu2.6_i386.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3710-1) libcurl3-nss_7.55.1-1ubuntu2.6_amd64.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3710-1) libcurl3-gnutls_7.55.1-1ubuntu2.6_i386.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3710-1) libcurl3-gnutls_7.55.1-1ubuntu2.6_amd64.deb | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234