CVE-2017-8818
published 2017-11-29CVE-2017-8818: curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have…
PriorityP434critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
0.83%
75.0th percentile
curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | curl | < curl 7.57.0-1 (bookworm) | curl 7.57.0-1 (bookworm) |
| haxx | curl | — | — |
| haxx | curl | — | — |
| haxx | curl | >= 0 < 7.57.0-1 | 7.57.0-1 |
| haxx | curl | >= 0 < 7.57.0-1 | 7.57.0-1 |
| haxx | curl | >= 0 < 7.57.0-1 | 7.57.0-1 |
| haxx | curl | >= 0 < 7.57.0-1 | 7.57.0-1 |
| haxx | libcurl | — | — |
| haxx | libcurl | — | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rm6j-8x6m-cxhp: curl and libcurl before 7
ghsa_unreviewed·2022-05-17
CVE-2017-8818 [CRITICAL] CWE-119 GHSA-rm6j-8x6m-cxhp: curl and libcurl before 7
curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library.
OSV
CVE-2017-8818: curl and libcurl before 7
osv·2017-11-29·CVSS 9.8
CVE-2017-8818 [CRITICAL] CVE-2017-8818: curl and libcurl before 7
curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library.
Red Hat
curl: Out-of-bound access in SSL related cleanup code
vendor_redhat·2017-11-29·CVSS 9.8
CVE-2017-8818 [CRITICAL] CWE-125 curl: Out-of-bound access in SSL related cleanup code
curl: Out-of-bound access in SSL related cleanup code
curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library.
Package: rh-dotnetcore10-curl (.NET Core 1.0 on Red Hat Enterprise Linux) - Not affected
Package: rh-dotnetcore11-curl (.NET Core 1.1 on Red Hat Enterprise Linux) - Not affected
Package: rh-dotnet20-curl (.NET Core 2.0 on Red Hat Enterprise Linux) - Not affected
Package: curl (Red Hat Ceph Storage 2) - Not affected
Package: curl (Red Hat Enterprise Linux 5) - Not affected
Package: curl (Red Hat Enterprise Linux 6) - Not affected
Package: curl (Red Hat Enterprise Linux 7) - Not
Debian
CVE-2017-8818: curl - curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a de...
vendor_debian·2017·CVSS 9.8
CVE-2017-8818 [CRITICAL] CVE-2017-8818: curl - curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a de...
curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library.
Scope: local
bookworm: resolved (fixed in 7.57.0-1)
bullseye: resolved (fixed in 7.57.0-1)
forky: resolved (fixed in 7.57.0-1)
sid: resolved (fixed in 7.57.0-1)
trixie: resolved (fixed in 7.57.0-1)
No detection rules found.
No public exploits indexed.
http://security.cucumberlinux.com/security/details.php?id=163http://www.securityfocus.com/bid/102014http://www.securitytracker.com/id/1039898https://curl.haxx.se/docs/adv_2017-af0a.htmlhttps://security.gentoo.org/glsa/201712-04http://security.cucumberlinux.com/security/details.php?id=163http://www.securityfocus.com/bid/102014http://www.securitytracker.com/id/1039898https://curl.haxx.se/docs/adv_2017-af0a.htmlhttps://security.gentoo.org/glsa/201712-04
2017-11-29
Published