CVE-2016-9586
published 2018-04-23CVE-2016-9586: curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions…
PriorityP339high8.1CVSS 3.0
AVNACHPRNUINSUCHIHAH
EPSS
1.01%
77.6th percentile
curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos_sierra_10.12.4_security_update_2017-001_el_capitan_and_security_update_201 | — | — |
| apple | macos_sierra_10.12.6_security_update_2017-003_el_capitan_and_security_update_201 | — | — |
| debian | curl | < curl 7.52.1-1 (bookworm) | curl 7.52.1-1 (bookworm) |
| haxx | curl | < 7.52.0 | 7.52.0 |
| haxx | curl | >= 0 < 7.52.1-1 | 7.52.1-1 |
| haxx | curl | >= 0 < 7.52.1-1 | 7.52.1-1 |
| haxx | curl | >= 0 < 7.52.1-1 | 7.52.1-1 |
| haxx | curl | >= 0 < 7.52.1-1 | 7.52.1-1 |
| haxx | curl | >= 0 < 7.35.0-1ubuntu2.11 | 7.35.0-1ubuntu2.11 |
| haxx | curl | >= 0 < 7.47.0-1ubuntu2.3 | 7.47.0-1ubuntu2.3 |
| redhat | curl | — | — |
CVSS provenance
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.1HIGH
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Hitachi Energy MSM Product
cisa_ics·2022-08-30·CVSS 4.3
[MEDIUM] Hitachi Energy MSM Product
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Hitachi Energy MSM Product
Last RevisedAugust 30, 2022
Alert CodeICSA-22-242-03
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.5
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Hitachi Energy
- Equipment: MSM Product
- Vulnerability: Reliance on Uncontrolled Component
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could disrupt the functionality of the MSM web interface, steal sensitive user credentials, or cause a denial-of-service condition.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Hitachi Energy reports multiple open-source softwar
Ubuntu
curl vulnerabilities
vendor_ubuntu·2017-10-23·CVSS 5.9
CVE-2016-9586 [MEDIUM] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
USN-3441-1 fixed several vulnerabilities in curl. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Daniel Stenberg discovered that curl incorrectly handled large floating
point output. A remote attacker could use this issue to cause curl to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-9586)
Even Rouault discovered that curl incorrectly handled large file names when
doing TFTP transfers. A remote attacker could use this issue to cause curl
to crash, resulting in a denial of service, or possibly obtain sensitive
memory contents. (CVE-2017-1000100)
Brian Carpenter and Yongji Ouyang discovered that curl incorrectly handle
Ubuntu
curl vulnerabilities
vendor_ubuntu·2017-10-10·CVSS 5.9
CVE-2016-9586 [MEDIUM] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Daniel Stenberg discovered that curl incorrectly handled large floating
point output. A remote attacker could use this issue to cause curl to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-9586)
Even Rouault discovered that curl incorrectly handled large file names when
doing TFTP transfers. A remote attacker could use this issue to cause curl
to crash, resulting in a denial of service, or possibly obtain sensitive
memory contents. (CVE-2017-1000100)
Brian Carpenter and Yongji Ouyang discovered that curl incorrectly handled
numerical range globbing. A remote attacker could use this issue to cause
curl to
Apple
CVE-2016-9586: macOS Sierra 10.12.6, Security Update 2017-003 El Capitan, and Security Update 2017-003 Yosemite
vendor_apple·2017-07-19·CVSS 5.9
CVE-2016-9586 [MEDIUM] CVE-2016-9586: macOS Sierra 10.12.6, Security Update 2017-003 El Capitan, and Security Update 2017-003 Yosemite
Apple Security Update: About the security content of macOS Sierra 10.12.6, Security Update 2017-003 El Capitan, and Security Update 2017-003 Yosemite
Product: macOS Sierra 10.12.6, Security Update 2017-003 El Capitan, and Security Update 2017-003 Yosemite
CVE: CVE-2016-9586
Component: CVE-2016-9586
Apple
CVE-2016-9586: macOS Sierra 10.12.4, Security Update 2017-001 El Capitan, and Security Update 2017-001 Yosemite
vendor_apple·2017-03-27·CVSS 5.9
CVE-2016-9586 [MEDIUM] CVE-2016-9586: macOS Sierra 10.12.4, Security Update 2017-001 El Capitan, and Security Update 2017-001 Yosemite
Apple Security Update: About the security content of macOS Sierra 10.12.4, Security Update 2017-001 El Capitan, and Security Update 2017-001 Yosemite
Product: macOS Sierra 10.12.4, Security Update 2017-001 El Capitan, and Security Update 2017-001 Yosemite
CVE: CVE-2016-9586
Component: CoreText
Impact: Processing a maliciously crafted text message may lead to application denial of service
Description: A resource exhaustion issue was addressed through improved input validation.
Red Hat
curl: printf floating point buffer overflow
vendor_redhat·2016-12-21·CVSS 5.9
CVE-2016-9586 [MEDIUM] CWE-122 curl: printf floating point buffer overflow
curl: printf floating point buffer overflow
curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.
Package: rh-dotnetcore10-curl (.NET Core 1.0 on Red Hat Enterprise Linux) - Out of support scope
Package: rh-dotnetcore11-curl (.NET Core 1.1 on Red Hat Enterprise Linux) - Out of support scope
Package: rh-dotnet20-curl (.NET Core 2.0 on Red Hat Enterprise Linux) - Out of support scope
Package: rh-dotnet21-curl (.NET Core 2.1 on Red Hat Enterprise Linux) - Will not fix
Package: curl (Red Hat Enterprise Linux 5) - Will not fix
Package: curl (Red H
Debian
CVE-2016-9586: curl - curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large...
vendor_debian·2016·CVSS 5.9
CVE-2016-9586 [MEDIUM] CVE-2016-9586: curl - curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large...
curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.
Scope: local
bookworm: resolved (fixed in 7.52.1-1)
bullseye: resolved (fixed in 7.52.1-1)
forky: resolved (fixed in 7.52.1-1)
sid: resolved (fixed in 7.52.1-1)
trixie: resolved (fixed in 7.52.1-1)
GHSA
GHSA-9xx8-h3pj-h4h9: curl before version 7
ghsa_unreviewed·2022-05-13
CVE-2016-9586 [HIGH] CWE-122 GHSA-9xx8-h3pj-h4h9: curl before version 7
curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.
OSV
CVE-2016-9586: curl before version 7
osv·2018-04-23·CVSS 8.1
CVE-2016-9586 [HIGH] CVE-2016-9586: curl before version 7
curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.
OSV
curl vulnerabilities
osv·2017-10-10·CVSS 8.1
CVE-2016-9586 [HIGH] curl vulnerabilities
curl vulnerabilities
Daniel Stenberg discovered that curl incorrectly handled large floating
point output. A remote attacker could use this issue to cause curl to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-9586)
Even Rouault discovered that curl incorrectly handled large file names when
doing TFTP transfers. A remote attacker could use this issue to cause curl
to crash, resulting in a denial of service, or possibly obtain sensitive
memory contents. (CVE-2017-1000100)
Brian Carpenter and Yongji Ouyang discovered that curl incorrectly handled
numerical range globbing. A remote attacker could use this issue to cause
curl to crash, resulting in a denial of service, or possibly obtain
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-9586 curl: printf floating point buffer overflow
bugzilla·2016-12-21·CVSS 5.9
CVE-2016-9586 [MEDIUM] CVE-2016-9586 curl: printf floating point buffer overflow
CVE-2016-9586 curl: printf floating point buffer overflow
libcurl's implementation of the printf() functions triggers a buffer overflow
when doing a large floating point output. The bug occurs when the conversion
outputs more than 255 bytes.
The flaw happens because the floating point conversion is using system
functions without the correct boundary checks.
The functions have been documented as deprecated for a long time and users are
discouraged from using them in "new programs" as they are planned to get
removed at a future point. But as the functions are present and there's
nothing preventing users from using them, we expect there to be a certain
amount of existing users in the wild.
If there are any application that accepts a format string from the outside
without necessary input f
Bugzilla
CVE-2016-9586 curl: printf floating point buffer overflow [fedora-all]
bugzilla·2016-12-21·CVSS 5.9
CVE-2016-9586 [MEDIUM] CVE-2016-9586 curl: printf floating point buffer overflow [fedora-all]
CVE-2016-9586 curl: printf floating point buffer overflow [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora.
Bugzilla
CVE-2016-9586 mingw-curl: curl: printf floating point buffer overflow [epel-7]
bugzilla·2016-12-21·CVSS 5.9
CVE-2016-9586 [MEDIUM] CVE-2016-9586 mingw-curl: curl: printf floating point buffer overflow [epel-7]
CVE-2016-9586 mingw-curl: curl: printf floating point buffer overflow [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
[bug automatically created by: add-tracking-bugs]
Bugzilla
CVE-2016-9586 mingw-curl: curl: printf floating point buffer overflow [fedora-all]
bugzilla·2016-12-21·CVSS 5.9
CVE-2016-9586 [MEDIUM] CVE-2016-9586 mingw-curl: curl: printf floating point buffer overflow [fedora-all]
CVE-2016-9586 mingw-curl: curl: printf floating point buffer overflow [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported version
arXiv
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
arxiv_fulltext·2022-12-29
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
## Abstract
Currently, the development of IoT firmware heavily depends on third-party components (TPCs) to improve development efficiency. Nevertheless, TPCs are not secure, and the vulnerabilities in TPCs will influence the security of IoT firmware. Existing works pay less attention to the vulnerabilities caused by TPCs, and we still lack a comprehensive understanding of the security impact of TPC vulnerability against firmware. To fill in the knowledge gap, we design and implement , which leverages syntactical features and control-flow graph features to detect the TPCs in firmware, and then recognizes the corresponding vulnerabilities. Based on , we present the first l
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlhttp://www.securityfocus.com/bid/95019http://www.securitytracker.com/id/1037515https://access.redhat.com/errata/RHSA-2018:3558https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9586https://curl.haxx.se/docs/adv_20161221A.htmlhttps://github.com/curl/curl/commit/curl-7_51_0-162-g3ab3c16https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2018/11/msg00005.htmlhttps://security.gentoo.org/glsa/201701-47http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlhttp://www.securityfocus.com/bid/95019http://www.securitytracker.com/id/1037515https://access.redhat.com/errata/RHSA-2018:3558https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9586https://curl.haxx.se/docs/adv_20161221A.htmlhttps://github.com/curl/curl/commit/curl-7_51_0-162-g3ab3c16https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2018/11/msg00005.htmlhttps://security.gentoo.org/glsa/201701-47
2018-04-23
Published