CVE-2016-7167
Critical · 9.8CVSS
9.8
EPSS
11.7%
Published
Oct 7, 2016
CISA due date
—
The record
Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Alpine:v3.10 | curl | 0 | 7.50.3-r0 |
| Alpine:v3.11 | curl | 0 | 7.50.3 |
| Alpine:v3.12 | curl | 0 | 7.50.3-r0 |
| Alpine:v3.13 | curl | 0 | 7.50.3-r0 |
| Alpine:v3.14 | curl | 0 | 7.50.3-r0 |
| Alpine:v3.15 | curl | 0 | 7.50.3-r0 |
| Alpine:v3.16 | curl | 0 | 7.50.3-r0 |
| Alpine:v3.17 | curl | 0 | 7.50.3-r0 |
| Alpine:v3.18 | curl | 0 | 7.50.3-r0 |
| Alpine:v3.19 | curl | 0 | 7.50.3-r0 |
| Alpine:v3.2 | curl | 0 | 7.49.1-r3 |
| Alpine:v3.20 | curl | 0 | 7.50.3-r0 |
| Alpine:v3.21 | curl | 0 | 7.50.3-r0 |
| Alpine:v3.22 | curl | 0 | 7.50.3-r0 |
| Alpine:v3.3 | curl | 0 | 7.49.1-r3 |
| Alpine:v3.4 | curl | 0 | 7.50.3-r0 |
| Alpine:v3.5 | curl | 0 | 7.50.3-r0 |
| Alpine:v3.6 | curl | 0 | 7.50.3 |
| Alpine:v3.7 | curl | 0 | 7.50.3 |
| Alpine:v3.8 | curl | 0 | 7.50.3 |
| Alpine:v3.9 | curl | 0 | 7.50.3-r1 |
| Debian:11 | curl | 0 | 7.51.0-1 |
| Debian:12 | curl | 0 | 7.51.0-1 |
| Debian:13 | curl | 0 | 7.51.0-1 |
| Debian:7 | curl | 0 | 7.26.0-1+wheezy16 |
| Debian:8 | curl | 0 | 7.38.0-4+deb8u13 |
| Mageia:5 | curl | 0 | 7.40.0-3.5.mga5 |
| Red Hat:enterprise_linux:7::client | curl | 0 | 0:7.29.0-42.el7 |
| Red Hat:enterprise_linux:7::client | curl-debuginfo | 0 | 0:7.29.0-42.el7 |
| Red Hat:enterprise_linux:7::client | libcurl | 0 | 0:7.29.0-42.el7 |
| Red Hat:enterprise_linux:7::client | libcurl-devel | 0 | 0:7.29.0-42.el7 |
| Red Hat:enterprise_linux:7::computenode | curl | 0 | 0:7.29.0-42.el7 |
| Red Hat:enterprise_linux:7::computenode | curl-debuginfo | 0 | 0:7.29.0-42.el7 |
| Red Hat:enterprise_linux:7::computenode | libcurl | 0 | 0:7.29.0-42.el7 |
| Red Hat:enterprise_linux:7::computenode | libcurl-devel | 0 | 0:7.29.0-42.el7 |
| Red Hat:enterprise_linux:7::server | curl | 0 | 0:7.29.0-42.el7 |
| Red Hat:enterprise_linux:7::server | curl-debuginfo | 0 | 0:7.29.0-42.el7 |
| Red Hat:enterprise_linux:7::server | libcurl | 0 | 0:7.29.0-42.el7 |
| Red Hat:enterprise_linux:7::server | libcurl-devel | 0 | 0:7.29.0-42.el7 |
| Red Hat:enterprise_linux:7::workstation | curl | 0 | 0:7.29.0-42.el7 |
| Red Hat:enterprise_linux:7::workstation | curl-debuginfo | 0 | 0:7.29.0-42.el7 |
| Red Hat:enterprise_linux:7::workstation | libcurl | 0 | 0:7.29.0-42.el7 |
| Red Hat:enterprise_linux:7::workstation | libcurl-devel | 0 | 0:7.29.0-42.el7 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-curl | 0 | 0:7.61.1-1.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-curl-debuginfo | 0 | 0:7.61.1-1.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-httpd | 0 | 0:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-httpd-debuginfo | 0 | 0:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-httpd-devel | 0 | 0:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-httpd-manual | 0 | 0:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-httpd-tools | 0 | 0:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-libcurl | 0 | 0:7.61.1-1.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-libcurl-devel | 0 | 0:7.61.1-1.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-libnghttp2 | 0 | 0:1.7.1-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-libnghttp2-devel | 0 | 0:1.7.1-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-mod_ldap | 0 | 0:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-mod_proxy_html | 0 | 1:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-mod_session | 0 | 0:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-mod_ssl | 0 | 1:2.4.34-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-nghttp2 | 0 | 0:1.7.1-7.el6 |
| Red Hat:rhel_software_collections:3::el6 | httpd24-nghttp2-debuginfo | 0 | 0:1.7.1-7.el6 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-curl | 0 | 0:7.61.1-1.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-curl-debuginfo | 0 | 0:7.61.1-1.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-httpd | 0 | 0:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-httpd-debuginfo | 0 | 0:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-httpd-devel | 0 | 0:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-httpd-manual | 0 | 0:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-httpd-tools | 0 | 0:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-libcurl | 0 | 0:7.61.1-1.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-libcurl-devel | 0 | 0:7.61.1-1.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-libnghttp2 | 0 | 0:1.7.1-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-libnghttp2-devel | 0 | 0:1.7.1-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-mod_ldap | 0 | 0:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-mod_md | 0 | 0:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-mod_proxy_html | 0 | 1:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-mod_session | 0 | 0:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-mod_ssl | 0 | 1:2.4.34-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-nghttp2 | 0 | 0:1.7.1-7.el7 |
| Red Hat:rhel_software_collections:3::el7 | httpd24-nghttp2-debuginfo | 0 | 0:1.7.1-7.el7 |
| SUSE:Linux Enterprise Desktop 12 SP1 | curl | 0 | 7.37.0-31.1 |
| SUSE:Linux Enterprise Server 11 SP4 | curl | 0 | 7.19.7-1.64.1 |
| SUSE:Linux Enterprise Server 11-SECURITY | curl-openssl1 | 0 | 7.19.7-1.64.1 |
| SUSE:Linux Enterprise Server 12 SP1 | curl | 0 | 7.37.0-31.1 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | curl | 0 | 7.19.7-1.64.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | curl | 0 | 7.37.0-31.1 |
| SUSE:Linux Enterprise Software Development Kit 11 SP4 | curl | 0 | 7.19.7-1.64.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | curl | 0 | 7.37.0-31.1 |
| SUSE:Studio Onsite 1.3 | curl | 0 | 7.19.7-1.20.47.2 |
| Ubuntu:14.04:LTS | curl | 0 | 7.35.0-1ubuntu2.10 |
| Ubuntu:16.04:LTS | curl | 0 | 7.47.0-1ubuntu2.2 |
| openSUSE:Tumbleweed | curl | 0 | 7.51.0-1.1 |
Related vulnerabilities
- CVE-2021-22898 curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line… Also affects curl
- CVE-2019-5481 Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. Also affects curl
- CVE-2019-5482 Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. Also affects curl
- CVE-2019-5436 A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code… Also affects curl
- CVE-2017-8817 The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to… Also affects curl
- CVE-2017-8816 The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms… Also affects curl
- CVE-2017-1000257 An IMAP FETCH response line indicates the size of the returned data, in number of bytes. Also affects curl
- CVE-2016-7141 curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is… Also affects curl