Published: 31/10/2018 Updated: 09/10/2019

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 670

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

A heap use-after-free flaw was found in curl versions from 7.59.0 up to and including 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.

Vulnerable Product	Search on Vulmon	Subscribe to Product
haxx curl
canonical ubuntu linux 16.04
canonical ubuntu linux 18.10
canonical ubuntu linux 14.04
canonical ubuntu linux 18.04

Several security issues were fixed in curl ...

Debian Bug report logs - #908327 curl: CVE-2018-14618: NTLM password overflow via integer overflow Package: src:curl; Maintainer for src:curl is Alessandro Ghedini <ghedo@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 8 Sep 2018 12:33:04 UTC Severity: serious Tags: fixed-upstream, secu ...

A heap use-after-free flaw was found in curl related to closing an easy handle When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct (CVE-2018-16840) Curl is v ...

libcurl is vulnerable to a heap buffer out-of-bounds read The function handling incoming NTLM type-2 messages (`lib/vauth/ntlmc:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length ...

A heap use-after-free flaw was found in curl versions from 7590 through 7611 in the code related to closing an easy handle When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that ...

CWE-416 https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f https://curl.haxx.se/docs/CVE-2018-16840.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16840 https://usn.ubuntu.com/3805-1/http://www.securitytracker.com/id/1042013 https://security.gentoo.org/glsa/201903-03 https://usn.ubuntu.com/3805-1/https://nvd.nist.gov

CVE-2018-16840

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect