CURL-CVE-2017-1000101
- Source
- https://curl.se/docs/CVE-2017-1000101.html
- Import Source
- https://curl.se/docs/CURL-CVE-2017-1000101.json
- JSON Data
- https://api.osv.dev/v1/vulns/CURL-CVE-2017-1000101
- Aliases
- Published
- 2017-08-09T08:00:00Z
- Modified
- 2024-07-02T09:22:24Z
- Summary
- URL globbing out of bounds read
- Details
-
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers.
In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing.
An example of a URL that triggers the flaw would be
http://ur%20[0-60000000000000000000. - References
-
- Credits
-
-
- Brian Carpenter - FINDER
-
- Yongji Ouyang - FINDER
-
- Daniel Stenberg - REMEDIATION_DEVELOPER
-