CVE-2016-7167HIGH
Description
Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.
References
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
http://www.securityfocus.com/bid/92975
http://www.securitytracker.com/id/1036813
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.538632
https://access.redhat.com/errata/RHSA-2017:2016
https://access.redhat.com/errata/RHSA-2018:2486
https://access.redhat.com/errata/RHSA-2018:3558
https://curl.haxx.se/docs/adv_20160914.html
https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html
Details
Source: MITRE
Published: 2016-10-07
Updated: 2018-11-13
Type: CWE-190
Risk Information
CVSS v2.0
Base Score: 7.5
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 10
Severity: HIGH
CVSS v3.0
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 3.9
Severity: CRITICAL
Vulnerable Software
Configuration 1
OR
cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
Configuration 2
OR
cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* versions up to 7.50.2 (inclusive)
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 125003 | EulerOS Virtualization 3.0.1.0 : curl (EulerOS-SA-2019-1550) | Nessus | Huawei Local Security Checks | high |
| 118753 | Debian DLA-1568-1 : curl security update | Nessus | Debian Local Security Checks | high |
| 102750 | CentOS 7 : curl (CESA-2017:2016) | Nessus | CentOS Local Security Checks | high |
| 102639 | Scientific Linux Security Update : curl on SL7.x x86_64 (20170801) | Nessus | Scientific Linux Local Security Checks | high |
| 102295 | Oracle Linux 7 : curl (ELSA-2017-2016) | Nessus | Oracle Linux Local Security Checks | high |
| 102111 | RHEL 7 : curl (RHSA-2017:2016) | Nessus | Red Hat Local Security Checks | high |
| 99881 | EulerOS 2.0 SP1 : curl (EulerOS-SA-2017-1036) | Nessus | Huawei Local Security Checks | high |
| 99880 | EulerOS 2.0 SP2 : curl (EulerOS-SA-2017-1035) | Nessus | Huawei Local Security Checks | high |
| 96644 | GLSA-201701-47 : cURL: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | high |
| 95917 | macOS 10.12.x < 10.12.2 Multiple Vulnerabilities | Nessus | MacOS X Local Security Checks | high |
| 9825 | cURL/libcurl 7.x < 7.50.3 RCE | Nessus Network Monitor | Web Clients | high |
| 94770 | Fedora 25 : curl (2016-08533fc59c) | Nessus | Fedora Local Security Checks | high |
| 94752 | openSUSE Security Update : curl (openSUSE-2016-1280) | Nessus | SuSE Local Security Checks | high |
| 94574 | Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS / 16.10 : curl vulnerabilities (USN-3123-1) | Nessus | Ubuntu Local Security Checks | high |
| 94572 | SUSE SLES11 Security Update : curl (SUSE-SU-2016:2714-1) | Nessus | SuSE Local Security Checks | high |
| 94506 | SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2016:2699-1) | Nessus | SuSE Local Security Checks | high |
| 93883 | Fedora 23 : curl (2016-80f4f71eff) | Nessus | Fedora Local Security Checks | high |
| 93743 | Amazon Linux AMI : curl (ALAS-2016-742) | Nessus | Amazon Linux Local Security Checks | high |
| 93565 | Debian DLA-625-1 : curl security update | Nessus | Debian Local Security Checks | high |
| 93551 | Fedora 24 : curl (2016-7a2ed52d41) | Nessus | Fedora Local Security Checks | high |
| 93535 | Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : curl (SSA:2016-259-01) | Nessus | Slackware Local Security Checks | high |
| 93498 | FreeBSD : cURL -- Escape and unescape integer overflows (b018121b-7a4b-11e6-bf52-b499baebfeaf) | Nessus | FreeBSD Local Security Checks | high |