CVE-2013-2174: Buffer Overflow

Published Jul 31, 2013

Updated

Heap-based buffer overflow in the curleasyunescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.

Affected Software

169 affected components

haxx curl=7.7

haxx curl=7.7.1

haxx curl=7.7.2

haxx curl=7.7.3

haxx curl=7.8

haxx curl=7.8.1

haxx curl=7.9

haxx curl=7.9.1

haxx curl=7.9.2

haxx curl=7.9.3

haxx curl=7.9.4

haxx curl=7.9.5

haxx curl=7.9.6

haxx curl=7.9.7

haxx curl=7.9.8

haxx curl=7.10

haxx curl=7.10.1

haxx curl=7.10.2

haxx curl=7.10.3

haxx curl=7.10.4

haxx curl=7.10.5

haxx curl=7.10.6

haxx curl=7.10.7

haxx curl=7.10.8

haxx curl=7.11.0

haxx curl=7.11.1

haxx curl=7.11.2

haxx curl=7.12.0

haxx curl=7.12.1

haxx curl=7.12.2

haxx curl=7.12.3

haxx curl=7.13.0

haxx curl=7.13.1

haxx curl=7.13.2

haxx curl=7.14.0

haxx curl=7.14.1

haxx curl=7.15.0

haxx curl=7.15.1

haxx curl=7.15.2

haxx curl=7.15.3

haxx curl=7.15.4

haxx curl=7.15.5

haxx curl=7.16.0

haxx curl=7.16.1

haxx curl=7.16.2

haxx curl=7.16.3

haxx curl=7.16.4

haxx curl=7.17.0

haxx curl=7.17.1

haxx curl=7.18.0

haxx curl=7.18.1

haxx curl=7.18.2

haxx curl=7.19.0

haxx curl=7.19.1

haxx curl=7.19.2

haxx curl=7.19.3

haxx curl=7.19.4

haxx curl=7.19.5

haxx curl=7.19.6

haxx curl=7.19.7

haxx curl=7.20.0

haxx curl=7.20.1

haxx curl=7.21.0

haxx curl=7.21.1

haxx curl=7.21.2

haxx curl=7.21.3

haxx curl=7.21.4

haxx curl=7.21.5

haxx curl=7.21.6

haxx curl=7.21.7

haxx curl=7.22.0

haxx curl=7.23.0

haxx curl=7.23.1

haxx curl=7.24.0

haxx curl=7.25.0

haxx curl=7.26.0

haxx curl=7.27.0

haxx curl=7.28.0

haxx curl=7.28.1

haxx curl=7.29.0

haxx curl=7.30.0

haxx libcurl=7.7

haxx libcurl=7.7.1

haxx libcurl=7.7.2

haxx libcurl=7.7.3

haxx libcurl=7.8

haxx libcurl=7.8.1

haxx libcurl=7.9

haxx libcurl=7.9.1

haxx libcurl=7.9.2

haxx libcurl=7.9.3

haxx libcurl=7.9.4

haxx libcurl=7.9.5

haxx libcurl=7.9.6

haxx libcurl=7.9.7

haxx libcurl=7.9.8

haxx libcurl=7.10

haxx libcurl=7.10.1

haxx libcurl=7.10.2

haxx libcurl=7.10.3

haxx libcurl=7.10.4

haxx libcurl=7.10.5

haxx libcurl=7.10.6

haxx libcurl=7.10.7

haxx libcurl=7.10.8

haxx libcurl=7.11.0

haxx libcurl=7.11.1

haxx libcurl=7.11.2

haxx libcurl=7.12.0

haxx libcurl=7.12.1

haxx libcurl=7.12.2

haxx libcurl=7.12.3

haxx libcurl=7.13.0

haxx libcurl=7.13.1

haxx libcurl=7.13.2

haxx libcurl=7.14.0

haxx libcurl=7.14.1

haxx libcurl=7.15.0

haxx libcurl=7.15.1

haxx libcurl=7.15.2

haxx libcurl=7.15.3

haxx libcurl=7.15.4

haxx libcurl=7.15.5

haxx libcurl=7.16.0

haxx libcurl=7.16.1

haxx libcurl=7.16.2

haxx libcurl=7.16.3

haxx libcurl=7.16.4

haxx libcurl=7.17.0

haxx libcurl=7.17.1

haxx libcurl=7.18.0

haxx libcurl=7.18.1

haxx libcurl=7.18.2

haxx libcurl=7.19.0

haxx libcurl=7.19.1

haxx libcurl=7.19.2

haxx libcurl=7.19.3

haxx libcurl=7.19.4

haxx libcurl=7.19.5

haxx libcurl=7.19.6

haxx libcurl=7.19.7

haxx libcurl=7.20.0

haxx libcurl=7.20.1

haxx libcurl=7.21.0

haxx libcurl=7.21.1

haxx libcurl=7.21.2

haxx libcurl=7.21.3

haxx libcurl=7.21.4

haxx libcurl=7.21.5

haxx libcurl=7.21.6

haxx libcurl=7.21.7

haxx libcurl=7.22.0

haxx libcurl=7.23.0

haxx libcurl=7.23.1

haxx libcurl=7.24.0

haxx libcurl=7.25.0

haxx libcurl=7.26.0

haxx libcurl=7.27.0

haxx libcurl=7.28.0

haxx libcurl=7.28.1

haxx libcurl=7.29.0

haxx libcurl=7.30.0

Canonical Ubuntu Linux=10.04

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=12.10

Canonical Ubuntu Linux=13.04

openSUSE openSUSE=11.4

redhat Enterprise Linux=5

redhat Enterprise Linux=6.0

Remediation

Patch Available

https://github.com/bagder/curl/commit/192c4f788d48f82c03e9cef40013f34370e90737

Event History

Jul 31, 2013

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-2174?

CVE-2013-2174 is rated as critical due to its potential for remote code execution and denial of service.

How do I fix CVE-2013-2174?

To fix CVE-2013-2174, upgrade to a version of cURL or libcurl that is 7.31.0 or later.

What devices are affected by CVE-2013-2174?

CVE-2013-2174 affects cURL and libcurl versions 7.7 through 7.30.0 across various operating systems.

What kind of attack is CVE-2013-2174 associated with?

CVE-2013-2174 is associated with heap-based buffer overflow attacks that can lead to application crashes or arbitrary code execution.

Is my system vulnerable to CVE-2013-2174?

If your system is running any version of cURL or libcurl from 7.7 to 7.30.0, it is vulnerable to CVE-2013-2174.