Description
The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
The Curl Project curl
7.51.0affected
References
- http://www.securityfocus.com/bid/94102 ↗
- https://access.redhat.com/errata/RHSA-2018:3558 ↗
- https://curl.haxx.se/docs/adv_20161102F.html ↗
- https://www.tenable.com/security/tns-2016-21 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8620 ↗
- http://www.securitytracker.com/id/1037192 ↗
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html ↗
- https://security.gentoo.org/glsa/201701-47 ↗