CVE-2017-1000257
published 2017-10-31CVE-2017-1000257: An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on…
PriorityP338critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.97%
77.1th percentile
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | curl | < curl 7.56.1-1 (bookworm) | curl 7.56.1-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| haxx | curl | >= 0 < 7.56.1-1 | 7.56.1-1 |
| haxx | curl | >= 0 < 7.56.1-1 | 7.56.1-1 |
| haxx | curl | >= 0 < 7.56.1-1 | 7.56.1-1 |
| haxx | curl | >= 0 < 7.56.1-1 | 7.56.1-1 |
| haxx | libcurl | 7.20.0 – 7.56.0 | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvdv3.09.1CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
osv9.1CRITICAL
vendor_debian9.1CRITICAL
vendor_redhat9.1CRITICAL
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
curl: IMAP FETCH response out of bounds read
vendor_redhat·2017-10-23·CVSS 9.1
CVE-2017-1000257 [CRITICAL] CWE-125 curl: IMAP FETCH response out of bounds read
curl: IMAP FETCH response out of bounds read
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.
A buffer overrun flaw was found in the IMAP handler of libcurl. By tricking an unsuspecting user into connecting to a malicious IMAP serv
Ubuntu
curl vulnerabilities
vendor_ubuntu·2017-10-23·CVSS 5.9
CVE-2016-9586 [MEDIUM] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
USN-3441-1 fixed several vulnerabilities in curl. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Daniel Stenberg discovered that curl incorrectly handled large floating
point output. A remote attacker could use this issue to cause curl to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-9586)
Even Rouault discovered that curl incorrectly handled large file names when
doing TFTP transfers. A remote attacker could use this issue to cause curl
to crash, resulting in a denial of service, or possibly obtain sensitive
memory contents. (CVE-2017-1000100)
Brian Carpenter and Yongji Ouyang discovered that curl incorrectly handle
Ubuntu
curl vulnerability
vendor_ubuntu·2017-10-23
CVE-2017-1000257 curl vulnerability
Title: curl vulnerability
Summary: curl could be made to crash or run programs if it received specially
crafted network traffic.
Brian Carpenter discovered that curl incorrectly handled IMAP FETCH
response lines. A remote attacker could use this issue to cause curl to
crash, resulting in a denial of service, or possibly execute arbitrary
code.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2017-1000257: curl - An IMAP FETCH response line indicates the size of the returned data, in number o...
vendor_debian·2017·CVSS 9.1
CVE-2017-1000257 [CRITICAL] CVE-2017-1000257: curl - An IMAP FETCH response line indicates the size of the returned data, in number o...
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.
Scope: local
bookworm: resolved (fixed in 7.56.1-1)
bullseye: resolved (fixed in 7.56.1-1)
forky: resolved (fixed in 7.56.1-1)
sid: resolved (fixed in 7.56.1-1)
trixie: resolved (fixed
VulDB
cURL up to 7.56.0 IMAP FETCH Response memory corruption (adv_20171023 / Nessus ID 104105)
vuldb·2026-04-16·CVSS 9.1
CVE-2017-1000257 [CRITICAL] cURL up to 7.56.0 IMAP FETCH Response memory corruption (adv_20171023 / Nessus ID 104105)
A vulnerability was found in cURL up to 7.56.0. It has been classified as critical. This vulnerability affects unknown code of the component IMAP FETCH Response Handler. The manipulation leads to memory corruption.
This vulnerability is uniquely identified as CVE-2017-1000257. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is recommended.
GHSA
GHSA-6x54-39w9-rqhw: An IMAP FETCH response line indicates the size of the returned data, in number of bytes
ghsa_unreviewed·2022-05-14
CVE-2017-1000257 [CRITICAL] CWE-119 GHSA-6x54-39w9-rqhw: An IMAP FETCH response line indicates the size of the returned data, in number of bytes
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.
OSV
CVE-2017-1000257: An IMAP FETCH response line indicates the size of the returned data, in number of bytes
osv·2017-10-31·CVSS 9.1
CVE-2017-1000257 [CRITICAL] CVE-2017-1000257: An IMAP FETCH response line indicates the size of the returned data, in number of bytes
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-1000257 curl: IMAP FETCH response out of bounds read [fedora-all]
bugzilla·2017-10-23·CVSS 9.1
CVE-2017-1000257 [CRITICAL] CVE-2017-1000257 curl: IMAP FETCH response out of bounds read [fedora-all]
CVE-2017-1000257 curl: IMAP FETCH response out of bounds read [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of
Bugzilla
CVE-2017-1000257 mingw-curl: curl: IMAP FETCH response out of bounds read [epel-7]
bugzilla·2017-10-23·CVSS 9.1
CVE-2017-1000257 [CRITICAL] CVE-2017-1000257 mingw-curl: curl: IMAP FETCH response out of bounds read [epel-7]
CVE-2017-1000257 mingw-curl: curl: IMAP FETCH response out of bounds read [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following template to for the
Bugzilla
CVE-2017-1000257 mingw-curl: curl: IMAP FETCH response out of bounds read [fedora-all]
bugzilla·2017-10-23·CVSS 9.1
CVE-2017-1000257 [CRITICAL] CVE-2017-1000257 mingw-curl: curl: IMAP FETCH response out of bounds read [fedora-all]
CVE-2017-1000257 mingw-curl: curl: IMAP FETCH response out of bounds read [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2017-1000257 curl: IMAP FETCH response out of bounds read
bugzilla·2017-10-18·CVSS 9.1
CVE-2017-1000257 [CRITICAL] CVE-2017-1000257 curl: IMAP FETCH response out of bounds read
CVE-2017-1000257 curl: IMAP FETCH response out of bounds read
An IMAP FETCH response line indicates the size of the returned data, in number
of bytes. When that response says the data is zero bytes, libcurl would pass
on that (non-existing) data with a pointer and the size (zero) to the
deliver-data function.
libcurl's deliver-data function treats zero as a magic number and invokes
strlen() on the data to figure out the length. The strlen() is called on a
heap based buffer that might not be zero terminated so libcurl might read
beyond the end of it into whatever memory lies after (or just crash) and then
deliver that to the application as if it was actually downloaded.
Introduced with:
https://github.com/curl/curl/commit/ec3bb8f727
External References:
https://curl.haxx.se/docs/adv_2
http://www.debian.org/security/2017/dsa-4007http://www.securityfocus.com/bid/101519http://www.securitytracker.com/id/1039644https://access.redhat.com/errata/RHSA-2017:3263https://access.redhat.com/errata/RHSA-2018:2486https://access.redhat.com/errata/RHSA-2018:3558https://curl.haxx.se/docs/adv_20171023.htmlhttps://security.gentoo.org/glsa/201712-04http://www.debian.org/security/2017/dsa-4007http://www.securityfocus.com/bid/101519http://www.securitytracker.com/id/1039644https://access.redhat.com/errata/RHSA-2017:3263https://access.redhat.com/errata/RHSA-2018:2486https://access.redhat.com/errata/RHSA-2018:3558https://curl.haxx.se/docs/adv_20171023.htmlhttps://security.gentoo.org/glsa/201712-04
2017-10-31
Published