CVE-2017-9502
published 2017-06-14CVE-2017-9502: In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl…
PriorityP424medium5.3CVSS 3.0
AVNACLPRNUINSUCNINAL
EPSS
0.55%
68.6th percentile
In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use when given a URL without a scheme part, had a flaw that could lead to it overwriting a heap based memory buffer with seven bytes. If the default protocol is specified to be FILE or a file: URL lacks two slashes, the given "URL" starts with a drive letter, and libcurl is built for Windows or DOS, then libcurl would copy the path 7 bytes off, so that the end of the given path would write beyond the malloc buffer (7 bytes being the length in bytes of the ascii string "file://").
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | curl | — | — |
| haxx | curl | <= 7.54.0 | — |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_debian5.3LOW
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
curl: URL file scheme drive letter buffer overflow
vendor_redhat·2017-06-14·CVSS 5.3
CVE-2017-9502 [MEDIUM] CWE-787 curl: URL file scheme drive letter buffer overflow
curl: URL file scheme drive letter buffer overflow
In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use when given a URL without a scheme part, had a flaw that could lead to it overwriting a heap based memory buffer with seven bytes. If the default protocol is specified to be FILE or a file: URL lacks two slashes, the given "URL" starts with a drive letter, and libcurl is built for Windows or DOS, then libcurl would copy the path 7 bytes off, so that the end of the given path would write beyond the malloc buffer (7 bytes being the length in bytes of the ascii string "file://").
Package: rh-dotnetcore10-curl (.NET Core 1.0 on Red Hat Enterprise Linux) - Not affected
Debian
CVE-2017-9502: curl - In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, w...
vendor_debian·2017·CVSS 5.3
CVE-2017-9502 [MEDIUM] CVE-2017-9502: curl - In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, w...
In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use when given a URL without a scheme part, had a flaw that could lead to it overwriting a heap based memory buffer with seven bytes. If the default protocol is specified to be FILE or a file: URL lacks two slashes, the given "URL" starts with a drive letter, and libcurl is built for Windows or DOS, then libcurl would copy the path 7 bytes off, so that the end of the given path would write beyond the malloc buffer (7 bytes being the length in bytes of the ascii string "file://").
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-2p6v-q44g-p7m7: In curl before 7
ghsa_unreviewed·2022-05-17
CVE-2017-9502 [MEDIUM] CWE-119 GHSA-2p6v-q44g-p7m7: In curl before 7
In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use when given a URL without a scheme part, had a flaw that could lead to it overwriting a heap based memory buffer with seven bytes. If the default protocol is specified to be FILE or a file: URL lacks two slashes, the given "URL" starts with a drive letter, and libcurl is built for Windows or DOS, then libcurl would copy the path 7 bytes off, so that the end of the given path would write beyond the malloc buffer (7 bytes being the length in bytes of the ascii string "file://").
No detection rules found.
No public exploits indexed.
http://openwall.com/lists/oss-security/2017/06/14/1http://www.securityfocus.com/bid/99120http://www.securitytracker.com/id/1038697https://curl.haxx.se/docs/adv_20170614.htmlhttp://openwall.com/lists/oss-security/2017/06/14/1http://www.securityfocus.com/bid/99120http://www.securitytracker.com/id/1038697https://curl.haxx.se/docs/adv_20170614.html
2017-06-14
Published