In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use when given a URL without a scheme part, had a flaw that could lead to it overwriting a heap based memory buffer with seven bytes. If the default protocol is specified to be FILE or a file: URL lacks two slashes, the given "URL" starts with a drive letter, and libcurl is built for Windows or DOS, then libcurl would copy the path 7 bytes off, so that the end of the given path would write beyond the malloc buffer (7 bytes being the length in bytes of the ascii string "file://").
References
Link | Resource |
---|---|
http://openwall.com/lists/oss-security/2017/06/14/1 | Mailing List Third Party Advisory |
http://www.securityfocus.com/bid/99120 | Third Party Advisory VDB Entry |
http://www.securitytracker.com/id/1038697 | |
https://curl.haxx.se/docs/adv_20170614.html | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2017-06-14T13:00:00
Updated: 2017-07-07T09:57:01
Reserved: 2017-06-07T00:00:00
Link: CVE-2017-9502
JSON object: View
NVD Information
Status : Modified
Published: 2017-06-14T13:29:00.747
Modified: 2017-07-08T01:29:22.270
Link: CVE-2017-9502
JSON object: View
Redhat Information
No data.
CWE