Out-of-bounds read in libcurl - CVE-2018-1000005
Published: January 25, 2018
Vulnerability identifier: #VU10223
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-1000005
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: curl.haxx.se
Affected software:
libcurl
libcurl
Detailed vulnerability description
The vulnerability allows a remote attacker to obtain potentially sensitive information or cause DoS condition on the target system.
The weakness exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted HTTP/2 trailer to trigger an out-of-bounds memory read error and cause the application to crash or obtain potentially sensitive information from services that echo back or otherwise use the trailers.
The weakness exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted HTTP/2 trailer to trigger an out-of-bounds memory read error and cause the application to crash or obtain potentially sensitive information from services that echo back or otherwise use the trailers.
How to mitigate CVE-2018-1000005
Update to version 7.58.0.