UBUNTU-CVE-2016-8622

See a problem?

Source

https://ubuntu.com/security/notices/UBUNTU-CVE-2016-8622

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-8622.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2016-8622

Related

Published

2016-11-02T00:00:00Z

Modified

2016-11-02T00:00:00Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

The URL percent-encoding decode function in libcurl before 7.51.0 is called curl_easy_unescape. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.

References

Affected packages

Ubuntu:14.04:LTS / curl

Package

Name: curl
Purl: pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.10?arch=src?distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.35.0-1ubuntu2.10

Affected versions

7.*

7.32.0-1ubuntu1

7.33.0-1ubuntu1

7.34.0-1ubuntu1

7.35.0-1ubuntu1

7.35.0-1ubuntu2

7.35.0-1ubuntu2.1

7.35.0-1ubuntu2.2

7.35.0-1ubuntu2.3

7.35.0-1ubuntu2.5

7.35.0-1ubuntu2.6

7.35.0-1ubuntu2.7

7.35.0-1ubuntu2.8

7.35.0-1ubuntu2.9

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "curl-udeb": "7.35.0-1ubuntu2.10",
            "libcurl3": "7.35.0-1ubuntu2.10",
            "libcurl4-gnutls-dev": "7.35.0-1ubuntu2.10",
            "libcurl3-dbgsym": "7.35.0-1ubuntu2.10",
            "libcurl3-nss": "7.35.0-1ubuntu2.10",
            "libcurl4-doc": "7.35.0-1ubuntu2.10",
            "libcurl3-udeb-dbgsym": "7.35.0-1ubuntu2.10",
            "libcurl3-gnutls-dbgsym": "7.35.0-1ubuntu2.10",
            "libcurl4-openssl-dev": "7.35.0-1ubuntu2.10",
            "libcurl4-openssl-dev-dbgsym": "7.35.0-1ubuntu2.10",
            "curl-dbgsym": "7.35.0-1ubuntu2.10",
            "curl": "7.35.0-1ubuntu2.10",
            "libcurl3-udeb": "7.35.0-1ubuntu2.10",
            "curl-udeb-dbgsym": "7.35.0-1ubuntu2.10",
            "libcurl4-nss-dev-dbgsym": "7.35.0-1ubuntu2.10",
            "libcurl3-gnutls": "7.35.0-1ubuntu2.10",
            "libcurl4-gnutls-dev-dbgsym": "7.35.0-1ubuntu2.10",
            "libcurl3-nss-dbgsym": "7.35.0-1ubuntu2.10",
            "libcurl3-dbg": "7.35.0-1ubuntu2.10",
            "libcurl4-nss-dev": "7.35.0-1ubuntu2.10"
        }
    ]
}

Ubuntu:16.04:LTS / curl

Package

Name: curl
Purl: pkg:deb/ubuntu/curl@7.47.0-1ubuntu2.2?arch=src?distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.47.0-1ubuntu2.2

Affected versions

7.*

7.43.0-1ubuntu2

7.45.0-1ubuntu1

7.46.0-1ubuntu1

7.47.0-1ubuntu1

7.47.0-1ubuntu2

7.47.0-1ubuntu2.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libcurl3": "7.47.0-1ubuntu2.2",
            "libcurl4-gnutls-dev": "7.47.0-1ubuntu2.2",
            "libcurl3-dbgsym": "7.47.0-1ubuntu2.2",
            "libcurl3-nss": "7.47.0-1ubuntu2.2",
            "libcurl4-doc": "7.47.0-1ubuntu2.2",
            "libcurl3-gnutls-dbgsym": "7.47.0-1ubuntu2.2",
            "libcurl4-openssl-dev": "7.47.0-1ubuntu2.2",
            "libcurl4-openssl-dev-dbgsym": "7.47.0-1ubuntu2.2",
            "curl-dbgsym": "7.47.0-1ubuntu2.2",
            "curl": "7.47.0-1ubuntu2.2",
            "libcurl4-nss-dev-dbgsym": "7.47.0-1ubuntu2.2",
            "libcurl3-gnutls": "7.47.0-1ubuntu2.2",
            "libcurl4-gnutls-dev-dbgsym": "7.47.0-1ubuntu2.2",
            "libcurl3-nss-dbgsym": "7.47.0-1ubuntu2.2",
            "libcurl3-dbg": "7.47.0-1ubuntu2.2",
            "libcurl4-nss-dev": "7.47.0-1ubuntu2.2"
        }
    ]
}