Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-j2qx-np45-4qdu
Vulnerability ID VCID-j2qx-np45-4qdu
Aliases CVE-2017-1000257
Summary Multiple vulnerabilities have been found in cURL, the worst of which may allow execution of arbitrary code.
Status Published
Exploitability 0.5
Weighted Severity 8.2
Risk 4.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-125 Out-of-bounds Read
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-126 Buffer Over-read
System Score Found at
cvssv3 4.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-1000257.json
epss 0.00875 https://api.first.org/data/v1/epss?cve=CVE-2017-1000257
epss 0.01001 https://api.first.org/data/v1/epss?cve=CVE-2017-1000257
epss 0.01001 https://api.first.org/data/v1/epss?cve=CVE-2017-1000257
epss 0.01001 https://api.first.org/data/v1/epss?cve=CVE-2017-1000257
epss 0.0109 https://api.first.org/data/v1/epss?cve=CVE-2017-1000257
epss 0.01419 https://api.first.org/data/v1/epss?cve=CVE-2017-1000257
epss 0.01419 https://api.first.org/data/v1/epss?cve=CVE-2017-1000257
epss 0.01419 https://api.first.org/data/v1/epss?cve=CVE-2017-1000257
epss 0.01419 https://api.first.org/data/v1/epss?cve=CVE-2017-1000257
epss 0.01419 https://api.first.org/data/v1/epss?cve=CVE-2017-1000257
cvssv3.1 Medium https://curl.se/docs/CVE-2017-1000257.html
cvssv2 4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 4.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 6.4 https://nvd.nist.gov/vuln/detail/CVE-2017-1000257
cvssv3 9.1 https://nvd.nist.gov/vuln/detail/CVE-2017-1000257
archlinux Medium https://security.archlinux.org/AVG-462
archlinux Medium https://security.archlinux.org/AVG-463
archlinux Medium https://security.archlinux.org/AVG-464
archlinux Medium https://security.archlinux.org/AVG-465
archlinux Medium https://security.archlinux.org/AVG-466
archlinux Medium https://security.archlinux.org/AVG-467
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2018:2486
https://access.redhat.com/errata/RHSA-2018:3558
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-1000257.json
https://api.first.org/data/v1/epss?cve=CVE-2017-1000257
https://curl.haxx.se/docs/adv_20171023.html
https://curl.se/docs/CVE-2017-1000257.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000257
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
http://www.debian.org/security/2017/dsa-4007
http://www.securityfocus.com/bid/101519
http://www.securitytracker.com/id/1039644
1503705 https://bugzilla.redhat.com/show_bug.cgi?id=1503705
ASA-201711-10 https://security.archlinux.org/ASA-201711-10
ASA-201711-11 https://security.archlinux.org/ASA-201711-11
ASA-201711-6 https://security.archlinux.org/ASA-201711-6
ASA-201711-7 https://security.archlinux.org/ASA-201711-7
ASA-201711-8 https://security.archlinux.org/ASA-201711-8
ASA-201711-9 https://security.archlinux.org/ASA-201711-9
AVG-462 https://security.archlinux.org/AVG-462
AVG-463 https://security.archlinux.org/AVG-463
AVG-464 https://security.archlinux.org/AVG-464
AVG-465 https://security.archlinux.org/AVG-465
AVG-466 https://security.archlinux.org/AVG-466
AVG-467 https://security.archlinux.org/AVG-467
cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
CVE-2017-1000257 https://nvd.nist.gov/vuln/detail/CVE-2017-1000257
GLSA-201712-04 https://security.gentoo.org/glsa/201712-04
RHSA-2017:3263 https://access.redhat.com/errata/RHSA-2017:3263
USN-3441-2 https://usn.ubuntu.com/3441-2/
USN-3457-1 https://usn.ubuntu.com/3457-1/
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-1000257.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:H/Au:N/C:N/I:P/A:P Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2017-1000257
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-1000257
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.75327
EPSS Score 0.00875
Published At April 16, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:12:00.340257+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/201712-04 38.0.0