DEBIAN-CVE-2017-1000101
- Source
- https://security-tracker.debian.org/tracker/DEBIAN-CVE-2017-1000101
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2017-1000101.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2017-1000101
- Upstream
- Published
- 2017-10-05T01:29:04Z
- Modified
- 2025-09-19T06:20:06Z
- Summary
- [none]
- Details
-
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be
http://ur%20[0-60000000000000000000. - References
Affected packages
Debian:11 / curl
Package
- Name
- curl
- Purl
- pkg:deb/debian/curl?arch=source
Debian:12 / curl
Package
- Name
- curl
- Purl
- pkg:deb/debian/curl?arch=source
Debian:13 / curl
Package
- Name
- curl
- Purl
- pkg:deb/debian/curl?arch=source
Debian:14 / curl
Package
- Name
- curl
- Purl
- pkg:deb/debian/curl?arch=source