PT-2018-13769 · Curl+3 · Curl+3
Brian Carpenter
·
Publicado
2018-10-31
·
Atualizado
2026-05-18
·
CVE-2018-16840
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
curl versions 7.59.0 through 7.61.1
Description
A heap use-after-free flaw was found in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the
Curl close() function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.Recommendations
For curl versions 7.59.0 through 7.61.1, consider updating to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting the use of the
Curl close() function until a patch is available.Correção
Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Suse
Ubuntu
Curl