VulnerableCode Package Details - pkg:alpm/archlinux/curl@7.56.0-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-4t2f-bfv9-aaan Aliases: CVE-2017-1000257	An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.	7.56.1-1 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-4t2f-bfv9-aaan
Aliases:
CVE-2017-1000257

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.

7.56.1-1
Affected by 3 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-daac-sxbr-aaas	libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.	CVE-2017-1000254

Vulnerability

Summary

Aliases

VCID-daac-sxbr-aaas

libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.

CVE-2017-1000254

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-03-28T07:47:06.877742+00:00	Arch Linux Importer	Fixing	VCID-daac-sxbr-aaas	https://security.archlinux.org/AVG-422	36.0.0
2025-03-28T07:46:56.921478+00:00	Arch Linux Importer	Affected by	VCID-4t2f-bfv9-aaan	https://security.archlinux.org/AVG-467	36.0.0
2024-10-20T17:34:03.990753+00:00	Arch Linux Importer	Fixing	VCID-daac-sxbr-aaas	https://security.archlinux.org/AVG-422	34.0.2
2024-10-20T17:34:03.435598+00:00	Arch Linux Importer	Affected by	VCID-4t2f-bfv9-aaan	https://security.archlinux.org/AVG-467	34.0.2
2024-09-18T02:02:30.875102+00:00	Arch Linux Importer	Fixing	VCID-daac-sxbr-aaas	https://security.archlinux.org/AVG-422	34.0.1
2024-09-18T02:02:18.273413+00:00	Arch Linux Importer	Affected by	VCID-4t2f-bfv9-aaan	https://security.archlinux.org/AVG-467	34.0.1
2024-01-31T12:10:01.534125+00:00	Arch Linux Importer	Fixing	VCID-daac-sxbr-aaas	https://security.archlinux.org/AVG-422	34.0.0rc2
2024-01-31T12:10:00.606448+00:00	Arch Linux Importer	Affected by	VCID-4t2f-bfv9-aaan	https://security.archlinux.org/AVG-467	34.0.0rc2
2024-01-03T22:28:31.450783+00:00	Arch Linux Importer	Fixing	VCID-daac-sxbr-aaas	https://security.archlinux.org/AVG-422	34.0.0rc1
2024-01-03T22:28:20.089245+00:00	Arch Linux Importer	Affected by	VCID-4t2f-bfv9-aaan	https://security.archlinux.org/AVG-467	34.0.0rc1