JLSEC-2025-38
- Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2025/JLSEC-2025-38.md
- Import Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-38.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/JLSEC-2025-38
- Upstream
- Published
- 2025-10-10T15:04:01.319Z
- Modified
- 2025-11-03T00:19:48.045581Z
- Summary
- libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Tim...
- Details
-
libcurl's ASN1 parser code has the
GTime2str()function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the time fraction, leading to astrlen()getting performed on a pointer to a heap buffer area that is not (purposely) null terminated.This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when CURLINFO_CERTINFO is used.
- Database specific
{ "sources": [ { "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7264", "id": "CVE-2024-7264", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-7264", "modified": "2024-11-21T09:51:10.360Z", "imported": "2025-10-10T14:33:22.352Z", "published": "2024-07-31T08:15:02.657Z" } ], "license": "CC-BY-4.0" }- References
-
- http://www.openwall.com/lists/oss-security/2024/07/31/1
- https://curl.se/docs/CVE-2024-7264.html
- https://curl.se/docs/CVE-2024-7264.json
- https://hackerone.com/reports/2629968
- https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519
- https://security.netapp.com/advisory/ntap-20240828-0008/
Affected packages
Julia / CURL_jll
Package
- Name
- CURL_jll
- Purl
- pkg:julia/CURL_jll?uuid=b21e61f3-bafc-59ac-ab14-4c5c62d6588d