Out-of-Bounds Access and Application Crash in curl
Summary
CVE-2017-8818: curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocate... Affects curl across 3 version ranges.
< 3ea76790571c1f7cf1bed34fabffd3cc20ad3dd3
< 7.57.0-r0
< c514af5a4f5ac3ce724065cc6a8e009373436f78
Fixed in 7.57.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package is a widely used open-source tool and library for transferring data with URLs. It provides support for various protocols, including HTTP, FTP, and SMTP. The package is commonly used in web applications, command-line tools, and scripting languages. However, versions of curl and libcurl prior to 7.57.0 on 32-bit platforms are vulnerable to an out-of-bounds access issue, which can lead to application crashes or other unspecified impacts. This vulnerability occurs due to insufficient memory allocation when interfacing with an SSL library.
Vulnerability Detail
The vulnerability, identified as CVE-2017-8818, allows attackers to exploit the insufficient memory allocation in curl and libcurl. By triggering an out-of-bounds access, an attacker can cause a denial of service by crashing the application. The impact of this vulnerability may extend beyond application crashes, potentially leading to other unspecified consequences. The severity of this vulnerability is rated as critical, with a CVSS score of 9.8.
How To Fix
Minimum fixed version
7.57.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the curl package to the latest version.
Conclusion
The out-of-bounds access vulnerability in curl and libcurl versions prior to 7.57.0 on 32-bit platforms can result in application crashes and other unspecified impacts. To mitigate this risk, it is essential to update the curl package to version 7.57.0 or later. Failure to apply the necessary fix may leave systems vulnerable to exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
Curl is an open-source tool and library for transferring data with URLs. It supports various protocols and is commonly used in web applications, command-line tools, and scripting languages.
The vulnerability can lead to a denial of service by causing application crashes. It may also have other unspecified impacts, potentially posing a risk to the integrity and availability of affected systems.
To fix this vulnerability, update the curl package to version 7.57.0 or later. This update includes the necessary memory allocation fixes to prevent the out-of-bounds access issue.
No, only versions of curl and libcurl prior to 7.57.0 on 32-bit platforms are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to update the curl package to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
