PT-2018-13769 · Curl+3 · Curl+3
Brian Carpenter
·
Published
2018-10-31
·
Updated
2026-05-18
·
CVE-2018-16840
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
curl versions 7.59.0 through 7.61.1
Description
A heap use-after-free flaw was found in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the
Curl close() function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.Recommendations
For curl versions 7.59.0 through 7.61.1, consider updating to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting the use of the
Curl close() function until a patch is available.Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Suse
Ubuntu
Curl