Curl - Out of Bounds Read in IMAP FETCH Response
Summary
DLA-1143-1: curl - security update. Affects curl versions < 7.26.0-1+wheezy22. Fixed in 7.26.0-1+wheezy22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Curl is a command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, FTP, and IMAP. Curl is widely used for fetching and sending data over the internet. In this case, the vulnerability affects the IMAP functionality of Curl.
Vulnerability Detail
The vulnerability, identified as CVE-2017-1000257, involves an out of bounds read during the processing of an IMAP FETCH response. This issue was independently reported by multiple researchers, including Brian Carpenter, Geeknik Labs, 0xd34db347, and the OSS-Fuzz project. An attacker could exploit this vulnerability to read data beyond the intended boundaries, potentially leading to information disclosure or a denial of service.
How To Fix
Minimum fixed version
7.26.0-1+wheezy22
This is the first release that contains the fix.
sudo apt-get install --only-upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, applying the recommended fix by upgrading the curl package will effectively mitigate the issue.
Conclusion
The out of bounds read vulnerability in Curl's IMAP FETCH response processing can be addressed by upgrading the curl package to version 7.26.0-1+wheezy22 or later. This update includes the necessary patches to fix the issue. If you require further assistance or support in resolving this vulnerability, please contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
Curl is a command-line tool and library for transferring data with URLs. It supports various protocols and is widely used for fetching and sending data over the internet.
The vulnerability could allow an attacker to read data beyond the intended boundaries, potentially leading to information disclosure or a denial of service.
The vulnerability was independently reported by Brian Carpenter, Geeknik Labs, 0xd34db347, and the OSS-Fuzz project.
To fix this vulnerability, you should upgrade the curl package to version 7.26.0-1+wheezy22 or later.
There is no specific workaround mentioned for this vulnerability. However, applying the recommended fix by upgrading the curl package will effectively mitigate the issue.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
