Out-of-bounds read in cURL - CVE-2024-6874

Vulnerability identifier: #VU94716

CSH Severity: Medium

CVSS v4 BT: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-6874

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the curl_url_get() function when parsing IDN URLs. A remote attacker can pass a specially crafted URL to the application, trigger an out-of-bounds read error and read contents of memory on the system.

cURL
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Basesystem Module
openSUSE Leap
SecurityCenter
LANTIME Operating System Firmware (LTOS)
webMethods Managed File Transfer
Storage Protect Backup-Archive Client
Data Lakehouse
IBM QRadar WinCollect Agent
curl
libcurl4-64bit
libcurl-devel-64bit
libcurl4-64bit-debuginfo
libcurl4-32bit
libcurl-devel-32bit
libcurl4-32bit-debuginfo
curl-fish-completion
libcurl-devel-doc
curl-zsh-completion
curl-debugsource
curl-debuginfo
curl-mini-debugsource
libcurl4
libcurl-mini4-debuginfo
libcurl-devel
libcurl4-debuginfo
libcurl-mini4

Install updates from vendor's website.

cURL - update to 8.9.0
SecurityCenter - addressed in versions SC-202408.1, SC-202504.2
LANTIME Operating System Firmware (LTOS) - update to 7.08.015
Data Lakehouse - update to 1.3.0.0
Storage Protect Backup-Archive Client - update to 8.1.24
curl - update to 8.14.1-150600.4.28.1
libcurl4-64bit - update to 8.14.1-150600.4.28.1
libcurl-devel-64bit - update to 8.14.1-150600.4.28.1
libcurl4-64bit-debuginfo - update to 8.14.1-150600.4.28.1
libcurl4-32bit - update to 8.14.1-150600.4.28.1
libcurl-devel-32bit - update to 8.14.1-150600.4.28.1
libcurl4-32bit-debuginfo - update to 8.14.1-150600.4.28.1
curl-fish-completion - update to 8.14.1-150600.4.28.1
libcurl-devel-doc - update to 8.14.1-150600.4.28.1
curl-zsh-completion - update to 8.14.1-150600.4.28.1
curl-debugsource - update to 8.14.1-150600.4.28.1
curl-debuginfo - update to 8.14.1-150600.4.28.1
curl-mini-debugsource - update to 8.14.1-150600.4.28.1
libcurl4 - update to 8.14.1-150600.4.28.1
libcurl-mini4-debuginfo - update to 8.14.1-150600.4.28.1
libcurl-devel - update to 8.14.1-150600.4.28.1
libcurl4-debuginfo - update to 8.14.1-150600.4.28.1
libcurl-mini4 - update to 8.14.1-150600.4.28.1
IBM QRadar WinCollect Agent - update to 10.1.12

• https://curl.se/docs/CVE-2024-6874.json
• https://curl.se/docs/CVE-2024-6874.html
• https://hackerone.com/reports/2604391
• http://www.openwall.com/lists/oss-security/2024/07/24/2

• Multiple vulnerabilities in cURL
• Multiple vulnerabilities in Tenable Security Center
• Multiple vulnerabilities in IBM QRadar WinCollect Agent
• Multiple vulnerabilities in IBM Storage Protect Backup-Archive Client
• Dell Data Lakehouse System software update for third-party components
• Tenable Security Center update for third-party components
• Multiple vulnerabilities in IBM webMethods Managed File Transfer
• Meinberg LANTIME firmware update for curl
• SUSE update for curl