CVE-2017-1000101
published 2017-10-05CVE-2017-1000101: curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the…
PriorityP430medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EPSS
0.60%
70.1th percentile
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.
Affected
40 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos_high_sierra_10.13.1_security_update_2017-001_sierra_and_security_update_20 | — | — |
| debian | curl | < curl 7.55.0-1 (bookworm) | curl 7.55.0-1 (bookworm) |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv8.1HIGH
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2017-1000101: macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan
vendor_apple·2017-10-31·CVSS 6.5
CVE-2017-1000101 [MEDIUM] CVE-2017-1000101: macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan
Apple Security Update: About the security content of macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan
Product: macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan
CVE: CVE-2017-1000101
Component: CoreText
Impact: Processing a maliciously crafted font file may lead to arbitrary code execution
Description: A memory consumption issue was addressed with improved memory handling.
Ubuntu
curl vulnerabilities
vendor_ubuntu·2017-10-23·CVSS 5.9
CVE-2016-9586 [MEDIUM] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
USN-3441-1 fixed several vulnerabilities in curl. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Daniel Stenberg discovered that curl incorrectly handled large floating
point output. A remote attacker could use this issue to cause curl to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-9586)
Even Rouault discovered that curl incorrectly handled large file names when
doing TFTP transfers. A remote attacker could use this issue to cause curl
to crash, resulting in a denial of service, or possibly obtain sensitive
memory contents. (CVE-2017-1000100)
Brian Carpenter and Yongji Ouyang discovered that curl incorrectly handle
Ubuntu
curl vulnerabilities
vendor_ubuntu·2017-10-10·CVSS 5.9
CVE-2016-9586 [MEDIUM] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Daniel Stenberg discovered that curl incorrectly handled large floating
point output. A remote attacker could use this issue to cause curl to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-9586)
Even Rouault discovered that curl incorrectly handled large file names when
doing TFTP transfers. A remote attacker could use this issue to cause curl
to crash, resulting in a denial of service, or possibly obtain sensitive
memory contents. (CVE-2017-1000100)
Brian Carpenter and Yongji Ouyang discovered that curl incorrectly handled
numerical range globbing. A remote attacker could use this issue to cause
curl to
Red Hat
curl: URL globbing out of bounds read
vendor_redhat·2017-08-09·CVSS 6.5
CVE-2017-1000101 [MEDIUM] CWE-125 curl: URL globbing out of bounds read
curl: URL globbing out of bounds read
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue
Debian
CVE-2017-1000101: curl - curl supports "globbing" of URLs, in which a user can pass a numerical range to ...
vendor_debian·2017·CVSS 6.5
CVE-2017-1000101 [MEDIUM] CVE-2017-1000101: curl - curl supports "globbing" of URLs, in which a user can pass a numerical range to ...
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.
Scope: local
bookworm: resolved (fixed in 7.55.0-1)
bullseye: resolved (fixed in 7.55.0-1)
forky: resolved (fixed in 7.55.0-1)
sid: resolved (fixed in 7.55.0-1)
trixie: resolved (fixed in 7.55.0-1)
GHSA
GHSA-qxxx-25g2-qj92: curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers
ghsa_unreviewed·2022-05-14
CVE-2017-1000101 [MEDIUM] CWE-119 GHSA-qxxx-25g2-qj92: curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.
OSV
curl vulnerabilities
osv·2017-10-10·CVSS 8.1
CVE-2016-9586 [HIGH] curl vulnerabilities
curl vulnerabilities
Daniel Stenberg discovered that curl incorrectly handled large floating
point output. A remote attacker could use this issue to cause curl to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-9586)
Even Rouault discovered that curl incorrectly handled large file names when
doing TFTP transfers. A remote attacker could use this issue to cause curl
to crash, resulting in a denial of service, or possibly obtain sensitive
memory contents. (CVE-2017-1000100)
Brian Carpenter and Yongji Ouyang discovered that curl incorrectly handled
numerical range globbing. A remote attacker could use this issue to cause
curl to crash, resulting in a denial of service, or possibly obtain
OSV
CVE-2017-1000101: curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers
osv·2017-10-05·CVSS 6.5
CVE-2017-1000101 [MEDIUM] CVE-2017-1000101: curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.
No detection rules found.
No public exploits indexed.
HackerOne
CVE-2017-1000101: cURL: URL globbing out of bounds read
hackerone·2018-05-16·CVSS 6.5
CVE-2017-1000101 [MEDIUM] CVE-2017-1000101: cURL: URL globbing out of bounds read
CVE-2017-1000101: cURL: URL globbing out of bounds read
**FYI, this security advisory will not be released until 9 August 2017:**
```
curl supports "globbing" of URLs, in which a user can pass a numerical range
to have the tool iterate over those numbers to do a sequence of transfers.
In the globbing function that parses the numerical range, there was an
omission that made curl read a byte beyond the end of the URL if given a
carefully crafted, or just wrongly written, URL. The URL is stored in a heap
based buffer, so it could then be made to wrongly read something else instead
of crashing.
An example of a URL that triggers the flaw would be
`http://ur%20[0-60000000000000000000`.
```
Reported to project maintainers: 14 June 2017
Acknowledged: 14 June 2017
Patched: 14 June 2017
Released
Bugzilla
CVE-2017-1000100 CVE-2017-1000101 mingw-curl: various flaws [epel-7]
bugzilla·2017-08-09·CVSS 6.5
CVE-2017-1000100 [MEDIUM] CVE-2017-1000100 CVE-2017-1000101 mingw-curl: various flaws [epel-7]
CVE-2017-1000100 CVE-2017-1000101 mingw-curl: various flaws [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following template to for the 'fedpkg update
Bugzilla
CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000101 curl: various flaws [fedora-all]
bugzilla·2017-08-09·CVSS 6.5
CVE-2017-1000099 [MEDIUM] CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000101 curl: various flaws [fedora-all]
CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000101 curl: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported ve
Bugzilla
CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000101 mingw-curl: various flaws [fedora-all]
bugzilla·2017-08-09·CVSS 6.5
CVE-2017-1000099 [MEDIUM] CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000101 mingw-curl: various flaws [fedora-all]
CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000101 mingw-curl: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple suppor
Bugzilla
CVE-2017-1000101 curl: URL globbing out of bounds read
bugzilla·2017-08-04·CVSS 6.5
CVE-2017-1000101 [MEDIUM] CVE-2017-1000101 curl: URL globbing out of bounds read
CVE-2017-1000101 curl: URL globbing out of bounds read
curl supports "globbing" of URLs, in which a user can pass a numerical range
to have the tool iterate over those numbers to do a sequence of transfers.
In the globbing function that parses the numerical range, there was an
omission that made curl read a byte beyond the end of the URL if given a
carefully crafted, or just wrongly written, URL. The URL is stored in a heap
based buffer, so it could then be made to wrongly read something else instead
of crashing.
Affected versions: curl 7.34.0 up to and including 7.54.1
This flaw only affects the curl command line tool, not the libcurl library.
Discussion:
Acknowledgments:
Name: the Curl project
Upstream: Brian Carpenter
---
Created attachment 1308972
Upstream patch
---
Statemen
http://www.debian.org/security/2017/dsa-3992http://www.securityfocus.com/bid/100249http://www.securitytracker.com/id/1039117https://access.redhat.com/errata/RHSA-2018:3558https://curl.haxx.se/docs/adv_20170809A.htmlhttps://security.gentoo.org/glsa/201709-14https://support.apple.com/HT208221http://www.debian.org/security/2017/dsa-3992http://www.securityfocus.com/bid/100249http://www.securitytracker.com/id/1039117https://access.redhat.com/errata/RHSA-2018:3558https://curl.haxx.se/docs/adv_20170809A.htmlhttps://security.gentoo.org/glsa/201709-14https://support.apple.com/HT208221
2017-10-05
Published