CURL-CVE-2017-9502
Dashboard / Vulnerabilities / CURL-CVE-2017-9502
Summary: URL file scheme drive letter buffer overflow
Details: When libcurl is given either 1. a file: URL that does not use two slashes following the colon, or 2. is told that file is the default scheme to use for URLs without scheme ... and the given path starts with a drive letter and libcurl is built for Windows or DOS, then libcurl would copy the path with a wrong offset, so that the end of the given path would write beyond the malloc buffer. Up to seven bytes too much.
References:
Affected packages
Package
Name:
Purl:
Affected ranges
Type: SEMVER
Events:
Introduced- 7.53.0
Fixed -7.54.1
Affected versions
7.54.0
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
