Integer Overflow or Wraparound in curl | CVE-2016-7167

Q: How to fix?

Upgrade Alpine:3.16 curl to version 7.50.3-r0 or higher.

Threat Intelligence

2.29% (85^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Integer Overflow or Wraparound vulnerabilities in an interactive lesson.

Start learning

Snyk IDSNYK-ALPINE316-CURL-2842041
published7 Oct 2016
disclosed7 Oct 2016

Report a new vulnerability Found a mistake?

Introduced: 7 Oct 2016

CVE-2016-7167 (opens in a new tab) CWE-190 (opens in a new tab)

How to fix?

Upgrade Alpine:3.16 curl to version 7.50.3-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Alpine. See How to fix? for Alpine:3.16 relevant fixed versions and status.

Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.

Integer Overflow or Wraparound Affecting curl package, versions <7.50.3-r0

Severity