| Revision Date: | 2017-06-14 | Version: | 1 | | Title: | CVE-2017-9502 on Ubuntu 16.04 LTS (xenial) - medium. | | Description: | In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use when given a URL without a scheme part, had a flaw that could lead to it overwriting a heap based memory buffer with seven bytes. If the default protocol is specified to be FILE or a file: URL lacks two slashes, the given "URL" starts with a drive letter, and libcurl is built for Windows or DOS, then libcurl would copy the path 7 bytes off, so that the end of the given path would write beyond the malloc buffer (7 bytes being the length in bytes of the ascii string "file://").
| | Family: | unix | Class: | vulnerability | | Status: | | Reference(s): | CVE-2017-9502
| | Platform(s): | Ubuntu 16.04 LTS
| Product(s): | | | Definition Synopsis | | Ubuntu 16.04 LTS (xenial) is installed. AND Package Information
NOT curl package in xenial, while related to the CVE in some way, is not affected (note: 'Windows/Dos only').
OR NOT libcurl3 package in xenial, while related to the CVE in some way, is not affected (note: 'Windows/Dos only').
OR NOT libcurl3-gnutls package in xenial, while related to the CVE in some way, is not affected (note: 'Windows/Dos only').
OR NOT libcurl3-nss package in xenial, while related to the CVE in some way, is not affected (note: 'Windows/Dos only').
|
|