CVE-2015-3237

Open Source Vulnerabilities CURL-CVE-2015-3237

libcurl can get tricked by a malicious SMB server to send off data it did not intend to. In libcurl's state machine function handling the SMB protocol (`smb_request_state()`), two length and offset values are extracted from data that has arrived over the network, and those values are subsequently used to figure out what data range to send back. The values are used and trusted without boundary checks and are assumed to be valid. This allows carefully handcrafted packages to trick libcurl into responding and sending off data that was not intended. Or crash if the values cause libcurl to access invalid memory.

Open Source Vulnerabilities CVE-2015-3237

The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.