PT-2017-10806 · Curl+3 · Curl+3

Brian Carpenter + 1 · Publicado 2017-08-09 · Atualizado 2026-05-18 · CVE-2017-1000101

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description The issue arises from the "globbing" function in curl that parses numerical ranges in URLs. If a user provides a carefully crafted or wrongly written URL, curl may read a byte beyond the end of the URL. This can lead to incorrect behavior instead of crashing, as the URL is stored in a heap-based buffer. An example of a URL that triggers this flaw is http://ur%20[0-60000000000000000000.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Over-read

Buffer Overflow

Enumeração de Fraquezas

CWE-126

CWE-119

Identificadores relacionados

ALT-PU-2017-2036

ALT-PU-2017-2049

ALT-PU-2018-2456

CLEANSTART-2026-AY18527

CLEANSTART-2026-BW46578

CLEANSTART-2026-DI23929

CLEANSTART-2026-LQ42192

CLEANSTART-2026-OF85770

CVE-2017-1000101

DSA-3992-1

MGASA-2017-0281

MGASA-2018-0053

OPENSUSE-SU-2024:10582-1

RHSA-2018:3558

SUSE-SU-2017:2174-1

SUSE-SU-2017:2699-1

SUSE-SU-2017:2700-1

USN-3441-1

Produtos afetados

Alt Linux

Suse

Ubuntu

Curl

Referências · 357

• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-BW46578.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-OF85770.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LQ42192.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AY18527.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DI23929.json · Nota
• https://osv.dev/vulnerability/CVE-2024-6197 · Nota
• https://osv.dev/vulnerability/CVE-2023-38039 · Nota
• https://osv.dev/vulnerability/CVE-2018-1000301 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-28321 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2022-27779 · Nota de Segurança
• https://suse.com/security/cve/CVE-2018-16842 · Nota
• https://suse.com/security/cve/CVE-2016-9586 · Nota
• https://curl.haxx.se/docs/adv_20161102I.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-7264 · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-1000099 · Nota