« Volver al listado

CVE-2017-8818

Estado: ModificadaCrítica (9.8)—

curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Haxx — CurlHaxx — Libcurl

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-8818",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": true,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@debian.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "curl and libcurl before 7.57.0",
          "versions": [
            {
              "status": "affected",
              "version": "curl and libcurl before 7.57.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-11-29T18:29:00.380",
  "references": [
    {
      "url": "http://security.cucumberlinux.com/security/details.php?id=163",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/102014",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1039898",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "https://curl.haxx.se/docs/adv_2017-af0a.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201712-04",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "http://security.cucumberlinux.com/security/details.php?id=163",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/102014",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1039898",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://curl.haxx.se/docs/adv_2017-af0a.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201712-04",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library."
    },
    {
      "lang": "es",
      "value": "curl y libcurl en versiones anteriores a la 7.57.0 en plataformas de 32 bits permiten que los atacantes provoquen una denegación de servicio (acceso fuera de límites y cierre inesperado de la aplicación) o, posiblemente, provoquen otro impacto porque se asigna demasiado poca memoria para interconectarse con una librería SSL."
    }
  ],
  "lastModified": "2026-06-17T01:27:01.050",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haxx:curl:7.56.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05A7C2E4-1DE8-40DE-AB2B-930E7435D005"
            },
            {
              "criteria": "cpe:2.3:a:haxx:curl:7.56.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F2AD970-AD25-4711-8D3C-B42F7616A36B"
            },
            {
              "criteria": "cpe:2.3:a:haxx:libcurl:7.56.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD56C515-5B37-4408-A909-ED45E6BAD643"
            },
            {
              "criteria": "cpe:2.3:a:haxx:libcurl:7.56.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C3467CA-68E0-4604-A107-586ECC27497F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@debian.org"
}