Multiple vulnerabilities in cURL



Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2024-6874
CVE-2024-6197
CWE-ID CWE-125
CWE-415
Exploitation vector Network
Public exploit N/A
Vulnerable software
 cURL
Client/Desktop applications / Other client software

Vendor curl.haxx.se

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Out-of-bounds read

EUVDB-ID: #VU94716

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-6874

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the curl_url_get() function when parsing IDN URLs. A remote attacker can pass a specially crafted URL to the application, trigger an out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

cURL: 8.8.0

CPE2.3 External links

http://curl.se/docs/CVE-2024-6874.json
http://curl.se/docs/CVE-2024-6874.html
http://hackerone.com/reports/2604391
http://www.openwall.com/lists/oss-security/2024/07/24/2


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Double free

EUVDB-ID: #VU94715

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-6197

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in ASN1 parser within the utf8asn1str() function. A remote attacker can pass specially crafted TLS certificate to the application, trigger double free error and execute arbitrary code on the target system.

The vulnerable code can only be reached when curl is built to use GnuTLS, wolfSSL, Schannel or Secure Transport.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

cURL: 8.6.0 - 8.8.0

CPE2.3 External links

http://curl.se/docs/CVE-2024-6197.json
http://curl.se/docs/CVE-2024-6197.html
http://hackerone.com/reports/2559516
http://www.openwall.com/lists/oss-security/2024/07/24/1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###