CVE-2016-0754: Input Validation
Published Jan 29, 2016
·Updated
cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name.
Affected Software
2 affected components
haxx curl<=7.46.0
Microsoft Windows
Event History
Jan 29, 2016
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-0754?
CVE-2016-0754 has been assigned a medium severity rating due to the potential for arbitrary file writes.
2
How do I fix CVE-2016-0754?
To fix CVE-2016-0754, upgrade cURL to version 7.47.0 or later.
3
Which versions of cURL are affected by CVE-2016-0754?
CVE-2016-0754 affects cURL versions prior to 7.47.0.
4
On which operating systems does CVE-2016-0754 occur?
CVE-2016-0754 specifically affects cURL running on Windows.
5
What type of vulnerability is CVE-2016-0754?
CVE-2016-0754 is a file write vulnerability that allows attackers to write files to arbitrary locations.