Denial of service in libcurl - CVE-2017-8818
Published: November 30, 2017
Vulnerability identifier: #VU9460
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-8818
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to too little memory is allocated for interfacing to an SSL library. A remote attacker can trigger a memory allocation error in SSL-related code and cause the application to crash.
Affected software
libcurl
Arch Linux
Gentoo Linux
Slackware Linux
curl (Alpine package)
QLogic Virtual Fabric Extension Module for IBM BladeCenter
Arch Linux
Gentoo Linux
Slackware Linux
curl (Alpine package)
QLogic Virtual Fabric Extension Module for IBM BladeCenter
How to mitigate CVE-2017-8818
Update to version 7.57.0.
curl (Alpine package) - update to 7.57.0-r0
QLogic Virtual Fabric Extension Module for IBM BladeCenter - update to 9.0.3.23.00
QLogic Virtual Fabric Extension Module for IBM BladeCenter - update to 9.0.3.23.00
External References
Related Security Bulletins
- Multiple vulnerabilities in libcurl
- Slackware Linux update for curl
- Arch Linux update for lib32-curl
- Arch Linux update for lib32-libcurl-gnutls
- Arch Linux update for lib32-libcurl-compat
- Gentoo update for cURL
- Denial of service in curl (Alpine package)
- Multiple vulnerabilities in Qlogic Virtual Fabric Extension Module for IBM BladeCenter Firmware Update