CVSS: 9.8EPSS: 4%CPEs: 4EXPL: 0CVE-2017-8816 – curl: NTLM buffer overflow via integer overflow
https://notcve.org/view.php?id=CVE-2017-8816
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields. La característica de autenticación NTLM en curl y libcurl en versiones anteriores a la 7.57.0 en plataformas de 32-bits permite que los atacantes provoquen una denegación de servicio (desbordamiento de enteros y desbordamiento de búfer resultante, y cierre inesperado de la aplicación) o que, posiblemente, causen otro tipo de impacto sin especificar mediante vectores relacionados con campos user y password largos. • http://security.cucumberlinux.com/security/details.php?id=161 http://www.securityfocus.com/bid/101998 http://www.securitytracker.com/id/1039896 http://www.securitytracker.com/id/1040608 https://access.redhat.com/errata/RHSA-2018:3558 https://curl.haxx.se/docs/adv_2017-12e7.html https://security.gentoo.org/glsa/201712-04 https://www.debian.org/security/2017/dsa-4051 https://access.redhat.com/security/cve/CVE-2017-8816 https://bugzilla.redhat.com/show_bug.cgi?id=1515757 • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 0CVE-2017-8817 – curl: FTP wildcard out of bounds read
https://notcve.org/view.php?id=CVE-2017-8817
The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character. La función FTP wildcard en curl y libcurl en versiones anteriores a la 7.57.0 permite que atacantes remotos provoquen una denegación de servicio (lectura fuera de límites y cierre inesperado de aplicación) o, probablemente, causen cualquier otro tipo de impacto mediante una cadena que termina con un carácter "[". • http://security.cucumberlinux.com/security/details.php?id=162 http://www.securityfocus.com/bid/102057 http://www.securitytracker.com/id/1039897 https://access.redhat.com/errata/RHSA-2018:3558 https://curl.haxx.se/docs/adv_2017-ae72.html https://lists.debian.org/debian-lts-announce/2017/11/msg00040.html https://security.gentoo.org/glsa/201712-04 https://www.debian.org/security/2017/dsa-4051 https://access.redhat.com/security/cve/CVE-2017-8817 https://bugzilla.redhat.com& • CWE-125: Out-of-bounds Read •
CVSS: 9.1EPSS: 2%CPEs: 3EXPL: 0CVE-2017-1000257 – curl: IMAP FETCH response out of bounds read
https://notcve.org/view.php?id=CVE-2017-1000257
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded. Una línea de respuesta IMAP FETCH indica el tamaño de los datos devueltos en número de bytes. Cuando una respuesta indica que el tamaño de los datos es cero bytes, libcurl pasaría esos datos (inexistentes) con un puntero y el tamaño (cero) a la función deliver-data. • http://www.debian.org/security/2017/dsa-4007 http://www.securityfocus.com/bid/101519 http://www.securitytracker.com/id/1039644 https://access.redhat.com/errata/RHSA-2017:3263 https://access.redhat.com/errata/RHSA-2018:2486 https://access.redhat.com/errata/RHSA-2018:3558 https://curl.haxx.se/docs/adv_20171023.html https://security.gentoo.org/glsa/201712-04 https://access.redhat.com/security/cve/CVE-2017-1000257 https://bugzilla.redhat.com/show_bug.cgi?id=1503705 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 117EXPL: 0CVE-2017-1000254 – curl: FTP PWD response parser out of bounds read
https://notcve.org/view.php?id=CVE-2017-1000254
libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. • http://www.debian.org/security/2017/dsa-3992 http://www.securityfocus.com/bid/101115 http://www.securitytracker.com/id/1039509 https://access.redhat.com/errata/RHSA-2018:2486 https://access.redhat.com/errata/RHSA-2018:3558 https://curl.haxx.se/673d0cd8.patch https://curl.haxx.se/docs/adv_20171004.html https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 32EXPL: 0CVE-2017-1000101 – curl: URL globbing out of bounds read
https://notcve.org/view.php?id=CVE-2017-1000101
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`. curl es compatible con el "globbing" de URL, donde un usuario puede pasar un rango numérico para hacer que la herramienta itere sobre esos números para realizar una secuencia de transferencias. En la función de "globbing" que analiza sintácticamente el rango numérico, hay una omisión que hace que curl lea un byte más allá del fin de la URL si se proporciona una URL manipulada o simplemente mal escrita. • http://www.debian.org/security/2017/dsa-3992 http://www.securityfocus.com/bid/100249 http://www.securitytracker.com/id/1039117 https://access.redhat.com/errata/RHSA-2018:3558 https://curl.haxx.se/docs/adv_20170809A.html https://security.gentoo.org/glsa/201709-14 https://support.apple.com/HT208221 https://access.redhat.com/security/cve/CVE-2017-1000101 https://bugzilla.redhat.com/show_bug.cgi?id=1478309 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •