CVE-2016-8618: Double Free
The libcurl API function called curlmaprintf() before version 7.51.0 can be tricked into doing a double-free due to an unsafe sizet multiplication, on systems using 32 bit sizet variables.
Other sources
The libcurl API function called curlmaprintf() can be tricked into doing a double-free due to an unsafe sizet multiplication, on systems using 32 bit sizet variables. The function is also used internallty in numerous situations.
The function doubles an allocated memory area with realloc() and allows the size to wrap and become zero and when doing so realloc() returns NULL and frees the memory - in contrary to normal realloc() fails where it only returns NULL - causing libcurl to free the memory again in the error path.
Systems with 64 bit versions of the sizet type are not affected by this issue.
This behavior is triggable using the publicly exposed function.
External References:
https://curl.haxx.se/docs/adv20161102D.html
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8618?
CVE-2016-8618 has a medium severity level due to its potential for causing a double-free vulnerability.
How do I fix CVE-2016-8618?
To fix CVE-2016-8618, update the libcurl library to version 7.51.0 or later.
What systems are affected by CVE-2016-8618?
CVE-2016-8618 affects systems using the libcurl API function 'curl_maprintf()' before version 7.51.0.
What could happen if CVE-2016-8618 is exploited?
If exploited, CVE-2016-8618 could lead to memory corruption, which might potentially allow an attacker to execute arbitrary code.
Are there any known exploits for CVE-2016-8618?
Yes, there are known vulnerabilities associated with CVE-2016-8618 that can be exploited on affected systems.