Integer Overflow to Buffer Overflow Affecting curl package, versions [7.10.5,8.12.0)

curl is a command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET and TFTP. libcurl offers a myriad of powerful features.

Affected versions of this package are vulnerable to Integer Overflow to Buffer Overflow in the gzip_do_write() function in content_encoding.c. If the CURLOPT_ACCEPT_ENCODING option is in use, enabling Content-Encoding: gzip, and the runtime version of zlib is older than 1.2.0.4 (released in 2003), this could allow code execution on the vulnerable server.

Although the attacker-controlled overflow allows for code execution, the realistic exploitability of this vulnerability is extremely limited by its reliance on the presence of a very outdated compression library. The project maintainers have therefore assessed Low severity for the issue despite its relatively high CVSS score. The vulnerability can be eliminated by upgrading or patching, but it is very likely that the only action needed is confirming that the zlib version in use is more recent than those that trigger the vulnerable code path.

• GitHub Commit
• GitHub PR
• HackerOne Report
• Vulnerability Advisory