CVE-2010-0734 content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which mi...
MediumCVSS 6.8
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| curl libcurl | = 7.10.5 | No fix listed |
| curl libcurl | = 7.10.6 | No fix listed |
| curl libcurl | = 7.10.7 | No fix listed |
| curl libcurl | = 7.10.8 | No fix listed |
| curl libcurl | = 7.11.0 | No fix listed |
| curl libcurl | = 7.11.1 | No fix listed |
| curl libcurl | = 7.11.2 | No fix listed |
| curl libcurl | = 7.12 | No fix listed |
| curl libcurl | = 7.12.0 | No fix listed |
| curl libcurl | = 7.12.1 | No fix listed |
| curl libcurl | = 7.12.2 | No fix listed |
| curl libcurl | = 7.12.3 | No fix listed |
| curl libcurl | = 7.13 | No fix listed |
| curl libcurl | = 7.13.1 | No fix listed |
| curl libcurl | = 7.13.2 | No fix listed |
| curl libcurl | = 7.14 | No fix listed |
| curl libcurl | = 7.14.1 | No fix listed |
| curl libcurl | = 7.15 | No fix listed |
| curl libcurl | = 7.15.1 | No fix listed |
| curl libcurl | = 7.15.2 | No fix listed |
| curl libcurl | = 7.15.3 | No fix listed |
| curl libcurl | = 7.16.3 | No fix listed |
| curl libcurl | = 7.17.0 | No fix listed |
| curl libcurl | = 7.17.1 | No fix listed |
| curl libcurl | = 7.18.0 | No fix listed |
Show 13 more
| Product | Affected versions | Fixed in |
|---|---|---|
| curl libcurl | = 7.18.1 | No fix listed |
| curl libcurl | = 7.18.2 | No fix listed |
| curl libcurl | = 7.19.0 | No fix listed |
| curl libcurl | = 7.19.1 | No fix listed |
| curl libcurl | = 7.19.2 | No fix listed |
| curl libcurl | = 7.19.3 | No fix listed |
| curl libcurl | = 7.19.4 | No fix listed |
| curl libcurl | = 7.19.5 | No fix listed |
| curl libcurl | = 7.19.6 | No fix listed |
| curl libcurl | = 7.19.7 | No fix listed |
| debian/curl(Debian:12) | < 7.20.0-1 | 7.20.0-1 |
| debian/curl(Debian:13) | < 7.20.0-1 | 7.20.0-1 |
| debian/curl(Debian:14) | < 7.20.0-1 | 7.20.0-1 |
References
- curl.haxx.se vendor-advisory
- curl.haxx.se vendor-advisory
- curl.haxx.se patch
- APPLE-SA-2010-06-15-1 vendor-advisory
- FEDORA-2010-2762 vendor-advisory
- FEDORA-2010-2720 vendor-advisory
- 38843 third-party-advisory
- 38981 third-party-advisory
- 39087 third-party-advisory
- 39734 third-party-advisory
- 40220 third-party-advisory
- 45047 third-party-advisory
- 48256 third-party-advisory
- GLSA-201203-02 vendor-advisory
- support.apple.com
- support.avaya.com
- wiki.rpath.com
- DSA-2023 vendor-advisory
- MDVSA-2010:062 vendor-advisory
- [oss-security] 20100209 CVE Request -- cURL/libCURL 7.20.0 mailing-list patch
- [oss-security] 20100309 Re: CVE Request -- cURL/libCURL 7.20.0 mailing-list patch
- [oss-security] 20100316 Re: CVE Request -- cURL/libCURL 7.20.0 mailing-list patch
- RHSA-2010:0329 vendor-advisory
- 20101027 rPSA-2010-0072-1 curl mailing-list
- 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX mailing-list
- USN-1158-1 vendor-advisory
- www.vmware.com
- ADV-2010-0571 vdb-entry
- ADV-2010-0602 vdb-entry
- ADV-2010-0660 vdb-entry
- ADV-2010-0725 vdb-entry
- ADV-2010-1481 vdb-entry
- bugzilla.redhat.com
- oval:org.mitre.oval:def:10760 signature vdb-entry
- oval:org.mitre.oval:def:6756 signature vdb-entry
- Debian Security Tracker CVE-2010-0734 vendor-advisory