CVE-2017-8816Integer Overflow or Wraparound in Curl

Severity
9.8CRITICALNVD
EPSS
0.5%
top 36.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedNov 29
Latest updateApr 16

Description

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

NVDhaxx/libcurl7.36.07.56.1
Debianhaxx/curl< 7.57.0-1+3
Ubuntuhaxx/curl< 7.35.0-1ubuntu2.13+1
NVDhaxx/curl7.56.1

Also affects: Debian Linux 8.0, 9.0

🔴Vulnerability Details

6
VulDB
cURL/libcURL up to 7.56.x on 32-bit NTLM Authentication integer overflow (RHSA-2018:3558 / Nessus ID 104861)2026-04-16
VulDB
Apple macOS up to 10.13.4 curl integer overflow (HT208692 / Nessus ID 105264)2026-04-16
GHSA
GHSA-2546-5j9r-qggh: The NTLM authentication feature in curl and libcurl before 72022-05-14
OSV
curl vulnerabilities2017-11-29
CVEList
CVE-2017-8816: The NTLM authentication feature in curl and libcurl before 72017-11-29

📋Vendor Advisories

5
Apple
CVE-2017-8816: macOS High Sierra 10.13.4, Security Update 2018-002 Sierra, and Security Update 2018-002 El Capitan2018-03-29
Apple
CVE-2017-8816: macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan2018-01-23
Red Hat
curl: NTLM buffer overflow via integer overflow2017-11-29
Ubuntu
curl vulnerabilities2017-11-29
Debian
CVE-2017-8816: curl - The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit plat...2017

💬Community

4
Bugzilla
CVE-2017-8816 CVE-2017-8817 curl: various flaws [fedora-all]2017-11-29
Bugzilla
CVE-2017-8816 CVE-2017-8817 mingw-curl: various flaws [epel-7]2017-11-29
Bugzilla
CVE-2017-8816 CVE-2017-8817 mingw-curl: various flaws [fedora-all]2017-11-29
Bugzilla
CVE-2017-8816 curl: NTLM buffer overflow via integer overflow2017-11-21
CVE-2017-8816 — Integer Overflow or Wraparound in Curl | cvebase