| Package | Affected versions | Patched versions |
|---|---|---|
| libcurl | ≥ 7.34.0, < 7.64.0 | 7.64.0 |
| communications operations monitor | = 3.4= 4.0 | |
| http server | = 12.2.1.3.0 | |
| secure global desktop | = 5.4 |
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free