Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value).

This update for curl fixes the following issues :

Security issue fixed :

  - CVE-2018-0500: Fix a SMTP send heap buffer overflow     (bsc#1099793).

This update was imported from the SUSE:SLE-15:Update update project.

set_file_metadata in xattr.c in GNU Wget stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.(CVE-2018-20483)

A heap-based buffer overflow has been found in the Curl_smtp_escape_eob() function of curl. An attacker could exploit this by convincing a user to use curl to upload data over SMTP with a reduced buffer to cause a crash or corrupt memory.(CVE-2018-0500)

An update of the curl package has been released.

- fix heap buffer overflow in SMTP send (CVE-2018-0500)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl fixes the following issues: Security issue fixed :

  - CVE-2018-0500: Fix a SMTP send heap buffer overflow     (bsc#1099793).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A heap-based buffer overflow has been found in the Curl_smtp_escape_eob() function of curl. An attacker could exploit this by convincing a user to use curl to upload data over SMTP with a reduced buffer to cause a crash or corrupt memory.(CVE-2018-0500)

The remote host is affected by the vulnerability described in GLSA-201807-04 (cURL: Heap-based buffer overflow)

    A heap-based buffer overflow was discovered in cURL&rsquo;s       Curl_smtp_escape_eob() function.
  Impact :

    An attacker could cause a Denial of Service condition or execute       arbitrary code via SMTP connections.
  Workaround :

    There is no known workaround at this time.

Peter Wu reports :

curl might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer.

Peter Wu discovered that curl incorrectly handled certain SMTP buffers. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New curl packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix a security issue.

ID	Name	Product	Family	Severity
123275	openSUSE Security Update : curl (openSUSE-2019-633)	Nessus	SuSE Local Security Checks	critical
122035	Amazon Linux AMI : curl (ALAS-2019-1151)	Nessus	Amazon Linux Local Security Checks	critical
121995	Photon OS 2.0: Curl PHSA-2018-2.0-0096	Nessus	PhotonOS Local Security Checks	critical
121889	Photon OS 1.0: Curl PHSA-2018-1.0-0186	Nessus	PhotonOS Local Security Checks	critical
120440	Fedora 28 : curl (2018-57779d51c1)	Nessus	Fedora Local Security Checks	critical
120084	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2018:2423-1)	Nessus	SuSE Local Security Checks	critical
112007	openSUSE Security Update : curl (openSUSE-2018-908)	Nessus	SuSE Local Security Checks	critical
111606	Amazon Linux 2 : curl (ALAS-2018-1052)	Nessus	Amazon Linux Local Security Checks	critical
111412	GLSA-201807-04 : cURL: Heap-based buffer overflow	Nessus	Gentoo Local Security Checks	critical
111405	FreeBSD : curl -- SMTP send heap buffer overflow (3849e28f-8693-11e8-9610-9c5c8e75236a)	Nessus	FreeBSD Local Security Checks	critical
111038	Ubuntu 18.04 LTS : curl vulnerability (USN-3710-1)	Nessus	Ubuntu Local Security Checks	critical
111036	Slackware 14.0 / 14.1 / 14.2 / current : curl (SSA:2018-192-02)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2018-0500

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical