The URL percent-encoding decode function in libcurl before 7.51.0 is...
Vulnerability Description
The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-8622
Credits & Attribution
No credits recorded in the NVD database.
References
- https://access.redhat.com/errata/RHSA-2018:3558
- https://curl.haxx.se/docs/adv_20161102H.html
- https://www.tenable.com/security/tns-2016-21
- http://www.securitytracker.com/id/1037192
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/94105
- https://access.redhat.com/errata/RHSA-2018:2486
- https://security.gentoo.org/glsa/201701-47
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8622
More from The Curl Project
View All →Affected Vendor
The Curl Project
View all reports →