PT-2016-7247 · Curl+5 · Libcurl+5
Publicado
2016-09-14
·
Atualizado
2026-05-18
·
CVE-2016-7167
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
libcurl versions prior to 7.50.3
Description
The issue is caused by multiple integer overflows in the
curl escape(), curl easy escape(), curl unescape(), and curl easy unescape() functions. These functions perform string URL percent escaping and unescaping, and they accept custom string length inputs in signed integer arguments. The provided string length arguments were not properly checked, which could lead to a heap-based buffer overflow when a string of length 0xffffffff is passed. This occurs because the functions attempt to allocate zero bytes of heap memory and then write gigabytes of data into it.Recommendations
For libcurl versions prior to 7.50.3, update to version 7.50.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
curl escape(), curl easy escape(), curl unescape(), and curl easy unescape() functions until a patch is available. Avoid passing large or unvalidated string lengths to these functions to minimize the risk of exploitation.Correção
Integer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Suse
Ubuntu
Libcurl