CVE-2016-8622 The URL percent-encoding decode function in libcurl before 7.51.0 is called curl_easy_unescape. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB...
CriticalCVSS 9.8
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The URL percent-encoding decode function in libcurl before 7.51.0 is called curl_easy_unescape. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/curl(Debian:12) | < 7.51.0-1 | 7.51.0-1 |
| debian/curl(Debian:13) | < 7.51.0-1 | 7.51.0-1 |
| debian/curl(Debian:14) | < 7.51.0-1 | 7.51.0-1 |
| haxx libcurl | < 7.51.0 | 7.51.0 |
| alpine/curl(Alpine:v3.10) | < 7.51.0-r0 | 7.51.0-r0 |
| alpine/curl(Alpine:v3.11) | < 7.51.0 | 7.51.0 |
| alpine/curl(Alpine:v3.12) | < 7.51.0-r0 | 7.51.0-r0 |
| alpine/curl(Alpine:v3.13) | < 7.51.0-r0 | 7.51.0-r0 |
| alpine/curl(Alpine:v3.14) | < 7.51.0-r0 | 7.51.0-r0 |
| alpine/curl(Alpine:v3.15) | < 7.51.0-r0 | 7.51.0-r0 |
| alpine/curl(Alpine:v3.16) | < 7.51.0-r0 | 7.51.0-r0 |
| alpine/curl(Alpine:v3.17) | < 7.51.0-r0 | 7.51.0-r0 |
| alpine/curl(Alpine:v3.18) | < 7.51.0-r0 | 7.51.0-r0 |
| alpine/curl(Alpine:v3.19) | < 7.51.0-r0 | 7.51.0-r0 |
| alpine/curl(Alpine:v3.2) | < 7.49.1-r4 | 7.49.1-r4 |
| alpine/curl(Alpine:v3.20) | < 7.51.0-r0 | 7.51.0-r0 |
| alpine/curl(Alpine:v3.21) | < 7.51.0-r0 | 7.51.0-r0 |
| alpine/curl(Alpine:v3.22) | < 7.51.0-r0 | 7.51.0-r0 |
| alpine/curl(Alpine:v3.23) | < 7.51.0-r0 | 7.51.0-r0 |
| alpine/curl(Alpine:v3.24) | < 7.51.0-r0 | 7.51.0-r0 |
| alpine/curl(Alpine:v3.3) | < 7.49.1-r4 | 7.49.1-r4 |
| alpine/curl(Alpine:v3.4) | < 7.51.0-r0 | 7.51.0-r0 |
| alpine/curl(Alpine:v3.5) | < 7.51.0-r0 | 7.51.0-r0 |
| alpine/curl(Alpine:v3.6) | < 7.51.0 | 7.51.0 |
| alpine/curl(Alpine:v3.7) | < 7.51.0 | 7.51.0 |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/curl(Alpine:v3.8) | < 7.51.0 | 7.51.0 |
| alpine/curl(Alpine:v3.9) | < 7.51.0-r0 | 7.51.0-r0 |
| The curl Project curl | = 7.51.0 | No fix listed |
References
- Debian Security Tracker CVE-2016-8622 vendor-advisory
- www.oracle.com
- 94105 third-party-advisory vdb-entry
- 1037192 third-party-advisory vdb-entry
- RHSA-2018:2486 third-party-advisory vendor-advisory
- RHSA-2018:3558 vendor-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- curl.haxx.se patch vendor-advisory
- GLSA-201701-47 third-party-advisory vendor-advisory
- www.tenable.com third-party-advisory
- security.alpinelinux.org vendor-advisory