Out-of-bounds read in cURL - CVE-2016-9953
Published: March 12, 2018 / Updated: July 28, 2020
Vulnerability identifier: #VU32182
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-9953
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly have unspecified other impact via a wildcard certificate name, which triggers an out-of-bounds read.
Affected software
cURL
curl (Alpine package)
curl (Alpine package)
How to mitigate CVE-2016-9953
Install update from vendor's website.
cURL - update to 7.52.0
curl (Alpine package) - update to 7.52.1-r0
curl (Alpine package) - update to 7.52.1-r0