CVE-2017-8818

moderate-risk
Published 2017-11-29

curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library.

Do I need to act?

-
0.73% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (4)

Affected Vendors

Haxx

References (10)

Third Party Advisory http://security.cucumberlinux.com/security/details.php?id=163
Third Party Advisory http://www.securityfocus.com/bid/102014
Third Party Advisory http://www.securitytracker.com/id/1039898
Patch https://curl.haxx.se/docs/adv_2017-af0a.html
Third Party Advisory https://security.gentoo.org/glsa/201712-04
Third Party Advisory http://security.cucumberlinux.com/security/details.php?id=163
Third Party Advisory http://www.securityfocus.com/bid/102014
Third Party Advisory http://www.securitytracker.com/id/1039898
Patch https://curl.haxx.se/docs/adv_2017-af0a.html
Third Party Advisory https://security.gentoo.org/glsa/201712-04
44
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 2/34 · Minimal
Exposure 10/34 · Low