MGASA-2016-0316

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2016-0316.html
Import Source
https://advisories.mageia.org/MGASA-2016-0316.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2016-0316
Related
Published
2016-09-21T20:38:22Z
Modified
2016-09-21T20:30:14Z
Summary
Updated curl packages fix security vulnerability
Details

The four libcurl functions curlescape(), curleasyescape(), curlunescape and curleasyunescape perform string URL percent escaping and unescaping. They accept custom string length inputs in signed integer arguments. The provided string length arguments were not properly checked and due to arithmetic in the functions, passing in the length 0xffffffff (2^32-1 or UINT_MAX or even just -1) would end up causing an allocation of zero bytes of heap memory that curl would attempt to write gigabytes of data into (CVE-2016-7167).

References
Credits

Affected packages

Mageia:5 / curl

Package

Name
curl
Purl
pkg:rpm/mageia/curl?distro=mageia-5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.40.0-3.5.mga5

Ecosystem specific 

{
    "section": "core"
}