CVE-2016-8622

low-risk

Published 2018-07-31

The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.

Do I need to act?

1.6% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 3.7/10 Low

NETWORK / HIGH complexity

Affected Products (1)

Libcurl

Affected Vendors

Haxx

References (18)

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Third Party Advisory http://www.securityfocus.com/bid/94105

Third Party Advisory http://www.securitytracker.com/id/1037192

Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2486

https://access.redhat.com/errata/RHSA-2018:3558

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8622

Patch https://curl.haxx.se/docs/adv_20161102H.html

Third Party Advisory https://security.gentoo.org/glsa/201701-47

Third Party Advisory https://www.tenable.com/security/tns-2016-21