CVE-2017-1000101

Source
Severity Low
Remote No
Type Information disclosure
Description
A heap-based read buffer overflow has been found in curl < 7.55.0. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be http://ur%20[0-60000000000000000000. This flaw only affects the curl command line tool, not the libcurl library.
Group Package Affected Fixed Severity Status Ticket
AVG-370 curl 7.54.1-2 7.55-1 Medium Fixed
Date Advisory Group Package Severity Description
22 Aug 2017 ASA-201708-16 AVG-370 curl Medium information disclosure
References
https://curl.haxx.se/docs/adv_20170809A.html
https://curl.haxx.se/CVE-2017-1000101.patch