CVE-2016-8622: Integer Overflow
The URL percent-encoding decode function in libcurl before 7.51.0 is called curleasyunescape. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.
Other sources
The URL percent-encoding decode function in libcurl is called curleasyunescape. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.
This can be triggered by a user on a 64bit system if the user can send in a custom (very large) URL to a libcurl using program.
External References:
https://curl.haxx.se/docs/adv20161102H.html
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8622?
CVE-2016-8622 is considered a medium-severity vulnerability as it can lead to a buffer overflow in libcurl.
How do I fix CVE-2016-8622?
To fix CVE-2016-8622, upgrade libcurl to version 7.51.0 or later.
What software is affected by CVE-2016-8622?
CVE-2016-8622 affects versions of libcurl prior to 7.51.0.
What impact does CVE-2016-8622 have on system security?
CVE-2016-8622 could allow an attacker to exploit a buffer overflow, potentially leading to arbitrary code execution.
Is CVE-2016-8622 specific to any operating system?
CVE-2016-8622 is not limited to a specific operating system but affects libcurl across multiple platforms.