Buffer overflow in cURL - CVE-2016-9586
Published: April 23, 2018 / Updated: August 3, 2020
Vulnerability identifier: #VU33022
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-9586
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.
Affected software
cURL
Modular Switchgear Monitoring (MSM)
Amazon Linux AMI
Arch Linux
Fedora
curl (Alpine package)
curl
Dell EMC Unisphere Central
Modular Switchgear Monitoring (MSM)
Amazon Linux AMI
Arch Linux
Fedora
curl (Alpine package)
curl
Dell EMC Unisphere Central
How to mitigate CVE-2016-9586
Install update from vendor's website.
cURL - update to 7.52.0
curl (Alpine package) - update to 7.52.1-r0
Dell EMC Unisphere Central - update to 4.0.8.23220
curl - addressed in versions 7.47.1-10.fc24, 7.51.0-4.fc25
curl (Alpine package) - update to 7.52.1-r0
Dell EMC Unisphere Central - update to 4.0.8.23220
curl - addressed in versions 7.47.1-10.fc24, 7.51.0-4.fc25
External References
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/95019
- http://www.securitytracker.com/id/1037515
- https://access.redhat.com/errata/RHSA-2018:3558
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9586
- https://curl.haxx.se/docs/adv_20161221A.html
- https://github.com/curl/curl/commit/curl-7_51_0-162-g3ab3c16
- https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html
- https://security.gentoo.org/glsa/201701-47
Related Security Bulletins
- Buffer overflow in curl.haxx.se cURL
- Buffer overflow in curl (Alpine package)
- Arch Linux update for lib32-libcurl-gnutls
- Arch Linux update for lib32-libcurl-compat
- Arch Linux update for lib32-curl
- Arch Linux update for libcurl-gnutls
- Arch Linux update for libcurl-compat
- Arch Linux update for curl
- Amazon Linux AMI update for curl
- Multiple vulnerabilities in Hitachi Energy MSM Product
- Multiple vulnerabilities in Dell EMC Unisphere Central
- Fedora 25 update for curl
- Fedora 24 update for curl