PT-2019-2327 · Curl+2 · Libcurl+2
Published
2019-05-22
·
Updated
2026-05-18
·
CVE-2019-5435
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
libcurl versions 7.62.0 through 7.64.1
Description
The issue is related to an integer overflow in the
curl url set() function of the libcurl library. This overflow can lead to a buffer overflow, potentially allowing a remote attacker to cause a denial of service or impact the availability of protected information. The flaws are specific to 32-bit architectures and require excessive string input lengths to be triggered.Recommendations
For libcurl versions 7.62.0 through 7.64.1, consider updating to a version that fixes the integer overflow issue in the
curl url set() function to prevent potential buffer overflows.
As a temporary workaround, consider restricting input lengths to the curl url set() function to minimize the risk of exploitation.Exploit
Fix
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Ubuntu
Libcurl