The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.

A stack based buffer overflow flaw was found in the way libcurl used to uncompress zlib compressed data. If an application, using libcurl, was downloading compressed content over HTTP and asked libcurl to automatically uncompress data, it might lead to denial of service (application crash) or, potentially, to arbitrary code execution with the privileges of that application.

Upstream advisory: [1] http://curl.haxx.se/docs/adv20100209.html

Upstream patch: [2] http://curl.haxx.se/libcurl-contentencoding.patch

Affected versions of cURL/libCURL (from [1]): 7.10.5 to and including 7.19.7

Other references: [3] http://curl.haxx.se/docs/security.html#20100209 [4] http://curl.haxx.se/download.html

CVE Request: [5] http://www.openwall.com/lists/oss-security/2010/02/09/5

Acknowledgements:

Red Hat would like to thank Daniel Stenberg for responsibly reporting this issue. Upstream acknowledges Wesley Miaw as the original reporter.