Buffer Read Overrun Vulnerability in curl
Summary
DLA-883-1: curl - security update. Affects curl versions < 7.26.0-1+wheezy19. Fixed in 7.26.0-1+wheezy19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Curl is a widely used tool for downloading files from the internet. It provides a command-line interface to transfer data using various protocols such as HTTP, FTP, and more. The vulnerability in curl affects Debian 7 Wheezy, specifically version 7.26.0-1+wheezy18+deb7u1.
Vulnerability Detail
The vulnerability in curl is a buffer read overrun issue. When the --write-out parameter ends with a "%" character, the trailing NUL character of the string is skipped. This can lead to accessing memory beyond the buffer's end, potentially exposing sensitive information as part of the output.
How To Fix
Minimum fixed version
7.26.0-1+wheezy19
This is the first release that contains the fix.
sudo apt-get install --only-upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The buffer read overrun vulnerability in curl can be fixed by upgrading to the recommended version. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
Curl is a command-line tool used for transferring data from or to a server, supporting various protocols such as HTTP, FTP, and more.
The buffer read overrun vulnerability in curl can potentially expose sensitive information from memory beyond the buffer's end.
The vulnerability affects curl version 7.26.0-1+wheezy18+deb7u1 on Debian 7 Wheezy.
To fix this vulnerability, you should upgrade the curl package to version 7.26.0-1+wheezy19 or later.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
