Information disclosure in libcurl



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2017-1000257
CWE-ID CWE-126
Exploitation vector Network
Public exploit N/A
Vulnerable software
 libcurl
Universal components / Libraries / Libraries used by multiple products

Vendor curl.haxx.se

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Buffer over-read

EUVDB-ID: #VU8917

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-1000257

CWE-ID: CWE-126 - Buffer over-read

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information or cause DoS condition on the target system.

The weakness exists due to buffer overread in the IMAP handle. A remote attacker can return a specially crafted IMAP FETCH response, obtain potentially sensitive information from memory on the target system or cause the target application using libcurl to crash.

Mitigation

Update to version 7.56.1.

Vulnerable software versions

libcurl: 7.20.1 - 7.56.0

CPE2.3 External links

https://curl.haxx.se/docs/adv_20171023.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###