CVE-2015-3237 Information disclosure in n/a

What is CVE-2015-3237?

CVE-2015-3237 is a medium-severity vulnerability in Haxx Curl, published on 22 Jun 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.

Weakness: CWE-20

Which versions are affected by CVE-2015-3237?

It affects 5 products.

Products include Haxx Curl, Haxx Libcurl, Hp System Management Homepage, Oracle Enterprise Manager Ops Center, Oracle Glassfish Server.

How do I fix CVE-2015-3237?

Upgrade to a fixed version.

Is CVE-2015-3237 being exploited?

There is no known exploitation of CVE-2015-3237 in the wild and no public exploit code.

Other vulnerabilities in Haxx Curl

• CVE-2026-19931 Negotiate ambient user conn reuse Critical 9.8
• CVE-2026-10536 HTTP/2 stream-dependency tree UAF Critical 9.8
• CVE-2026-11856 cross-origin Digest auth state leak Critical 9.8
• CVE-2026-8925 SASL double-free Critical 9.8
• CVE-2026-9079 stale proxy password leak Critical 9.8

All Haxx Curl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CURL-CVE-2015-3237, DEBIAN-CVE-2015-3237, GHSA-c5fx-333r-cgw4.