CVE-2016-7167: Buffer Overflow
It was found that provided string length arguments in four libcurl functions curlescape(), curleasyescape(), curlunescape and curleasyunescape were not properly checked and due to arithmetic in the functions, passing in the length 0xffffffff (2^32-1 or UINTMAX or even just -1) would end up causing an allocation of zero bytes of heap memory that curl would attempt to write gigabytes of data into.
This flaw does not affect the curl command line tool.
Affected versions: libcurl 7.11.1 to and including 7.50.2
External References:
https://curl.haxx.se/docs/adv20160914.html
Other sources
Multiple integer overflows in the (1) curlescape, (2) curleasyescape, (3) curlunescape, and (4) curleasyunescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7167?
CVE-2016-7167 is classified as a high severity vulnerability due to its potential to cause heap-based buffer overflows.
How do I fix CVE-2016-7167?
To fix CVE-2016-7167, upgrade libcurl to version 7.50.3 or later.
What impact can CVE-2016-7167 have on my system?
CVE-2016-7167 can allow attackers to exploit vulnerabilities in libcurl functions, potentially leading to arbitrary code execution.
What versions of libcurl are affected by CVE-2016-7167?
CVE-2016-7167 affects libcurl versions prior to 7.50.3.
Which software packages are impacted by CVE-2016-7167?
CVE-2016-7167 impacts curl packages on Red Hat and various versions of Fedora.