CVE-2016-8622: Integer Overflow
First published: Tue Oct 25 2016(Updated: )
The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Haxx Libcurl | <7.51.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/94105
- http://www.securitytracker.com/id/1037192
- https://access.redhat.com/errata/RHSA-2018:2486
- https://access.redhat.com/errata/RHSA-2018:3558
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8622
- https://curl.haxx.se/docs/adv_20161102H.html
- https://security.gentoo.org/glsa/201701-47
- https://www.tenable.com/security/tns-2016-21
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1213778&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1213778&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1390894
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1390895
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1390896
- https://bugzilla.redhat.com/show_bug.cgi?id=1388386
- collector/nvd-index
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-8622
- agent/software-canonical-lookup
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/haxx
- canonical/haxx libcurl
- package-manager/redhat