Medium severity4.3NVD Advisory· Published Feb 6, 2019· Updated Jun 17, 2026
CVE-2019-3823
CVE-2019-3823
Description
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to smtp_endofresp() isn't NUL terminated and contains no character ending the parsed number, and len is set to 5, then the strtol() call reads beyond the allocated buffer. The read contents will not be returned to the caller.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
22- osv-coords20 versionspkg:rpm/opensuse/curl&distro=openSUSE%20Leap%2015.0pkg:rpm/opensuse/curl&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/curl-mini&distro=openSUSE%20Leap%2015.0pkg:rpm/suse/curl&distro=SUSE%20Enterprise%20Storage%204pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSSpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSSpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4pkg:rpm/suse/curl&distro=SUSE%20OpenStack%20Cloud%207
< 7.60.0-lp150.2.18.1+ 19 more
- (no CPE)range: < 7.60.0-lp150.2.18.1
- (no CPE)range: < 7.79.1-1.1
- (no CPE)range: < 7.60.0-lp150.2.18.1
- (no CPE)range: < 7.37.0-37.34.1
- (no CPE)range: < 7.37.0-37.34.1
- (no CPE)range: < 7.60.0-4.3.1
- (no CPE)range: < 7.60.0-3.17.1
- (no CPE)range: < 7.37.0-37.34.1
- (no CPE)range: < 7.37.0-37.34.1
- (no CPE)range: < 7.37.0-37.34.1
- (no CPE)range: < 7.37.0-37.34.1
- (no CPE)range: < 7.60.0-4.3.1
- (no CPE)range: < 7.37.0-37.34.1
- (no CPE)range: < 7.37.0-37.34.1
- (no CPE)range: < 7.37.0-37.34.1
- (no CPE)range: < 7.37.0-37.34.1
- (no CPE)range: < 7.60.0-4.3.1
- (no CPE)range: < 7.37.0-37.34.1
- (no CPE)range: < 7.60.0-4.3.1
- (no CPE)range: < 7.37.0-37.34.1
- The curl Project/curlv5Range: 7.64.0
Patches
Vulnerability mechanics
References
12- curl.haxx.se/docs/CVE-2019-3823.htmlnvdPatchVendor Advisory
- www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlnvdPatchThird Party Advisory
- bugzilla.redhat.com/show_bug.cginvdExploitIssue TrackingPatchThird Party Advisory
- security.netapp.com/advisory/ntap-20190315-0001/nvdExploitThird Party Advisory
- www.securityfocus.com/bid/106950nvdThird Party AdvisoryVDB Entry
- security.gentoo.org/glsa/201903-03nvdThird Party Advisory
- usn.ubuntu.com/3882-1/nvdThird Party Advisory
- www.debian.org/security/2019/dsa-4386nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2019:3701nvd
- cert-portal.siemens.com/productcert/pdf/ssa-936080.pdfnvd
- lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3Envd
- www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlnvd
News mentions
0No linked articles in our index yet.