CURL-CVE-2017-9502
- Source
- https://curl.se/docs/CVE-2017-9502.html
- Import Source
- https://curl.se/docs/CURL-CVE-2017-9502.json
- JSON Data
- https://api.osv.dev/v1/vulns/CURL-CVE-2017-9502
- Aliases
- Published
- 2017-06-14T08:00:00Z
- Modified
- 2024-07-02T09:22:24Z
- Summary
- URL file scheme drive letter buffer overflow
- Details
-
When libcurl is given either
- a file: URL that does not use two slashes following the colon, or
- is told that file is the default scheme to use for URLs without scheme
... and the given path starts with a drive letter and libcurl is built for Windows or DOS, then libcurl would copy the path with a wrong offset, so that the end of the given path would write beyond the malloc buffer. Up to seven bytes too much.
- References
-
- Credits
-
-
- Marcel Raad - FINDER
-
- Daniel Stenberg - REMEDIATION_DEVELOPER
-