CVE-2017-1000099
When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers.
Published 9 y ago · modified 4 mo ago · JSON
Summary
When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this would send the wrong buffer to the user (stdout or the application's provide callback), which could lead to other private data from the heap to get inadvertently displayed. The wrong buffer was an uninitialized memory area allocated on the heap and if it turned out to not contain any zero byte, it would continue and display the data following that buffer in memory.
Exploit prediction (EPSS)
2.65% probability of exploitation in the next 30 days, higher than 86% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Classification
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- securityfocus.com /bid/100281 · vdb-entry, x_refsource_BID, x_transferred
- security.gentoo.org /glsa/201709-14 · vendor-advisory, x_refsource_GENTOO, x_transferred
- curl.haxx.se /0809C.patch · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1039119 · vdb-entry, x_refsource_SECTRACK, x_transferred
- curl.haxx.se /docs/adv_20170809C.html · Vendor Advisory
Sources
- CVE List: CVE-2017-1000099
- NVD: CVE-2017-1000099
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.