PT-2017-10804 · Curl+1 · Libcurl+1

Even Rouault · Published 2017-08-09 · Updated 2026-05-18 · CVE-2017-1000099

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions libcurl (affected versions not specified)

Description The issue arises when libcurl is used to retrieve a file from a file:// URL, and it attempts to provide meta-data about the file using HTTP-like headers. However, the code sends the wrong buffer to the user, which could be either stdout or the application's provided callback. This wrong buffer is an uninitialized memory area allocated on the heap. If this buffer does not contain any zero byte, the code will continue to display the data following that buffer in memory, potentially leading to the inadvertent display of other private data from the heap.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-170

CWE-200

Related Identifiers

ALT-PU-2017-2036

ALT-PU-2018-2456

CLEANSTART-2026-AY18527

CLEANSTART-2026-BW46578

CLEANSTART-2026-DI23929

CLEANSTART-2026-LQ42192

CLEANSTART-2026-OF85770

CVE-2017-1000099

MGASA-2017-0281

OPENSUSE-SU-2024:10582-1

Affected Products

Alt Linux

Libcurl

References · 320

• https://nvd.nist.gov/vuln/detail/CVE-2023-28321 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-27779 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-7264 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-0500 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-27781 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-27534 · Security Note
• https://osv.dev/vulnerability/MGASA-2017-0281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22924 · Security Note
• https://curl.haxx.se/docs/adv_20170809C.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000099 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8169 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22925 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000257 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-8619 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-0139 · Security Note