SB2017081039 - Fedora 26 update for curl
Published: August 10, 2017 Updated: April 24, 2025
Security Bulletin ID
SB2017081039
Severity
Low
Patch available
YES
Number of vulnerabilities
3
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Open redirect (CVE-ID: CVE-2017-1000100)
The vulnerability allows a remote attacker to redirect website visitors to external websites.The weakness exists due to incorrect validation of redirected URL. A remote attacker can redirect the target user's curl request to a TFTP URL with a long filename to cause the target user's curl application to send portions of system memory.
Successful exploitation of the vulnerability results in information disclosure.
2) Out-of-bounds read (CVE-ID: CVE-2017-1000101)
The vulnerability allows a remote attacker to redirect website visitors to external websites.The weakness exists due to out-of-bounds read. A local user can supply a URL containing specially crafted numerical range characters to trigger a heap read error and obtain potentially sensitive information from system memory
Successful exploitation of the vulnerability results in information disclosure.
3) Out-of-bounds read (CVE-ID: CVE-2017-1000099)
The vulnerability allows a local attacker to obtain potentially sensitive information.The weakness exists due to out-of bounds read. A local attacker can load a specially crafted 'file://' URL to cause the curl application to return data from system memory.
Successful exploitation of the vulnerability results in information disclosure.
Remediation
Install update from vendor's website.