NetSight
IP …
high7.5

CVE-2018-16890

libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read.

Impact

libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.

Affected products

VendorProductAffected versions
HaxxLibcurl
from 7.36.0 before 7.64.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04, 18.10
DebianDebian Linux
Version 9.0
NetappClustered Data Ontap
All versions
SiemensSinema Remote Connect Client
through 2.0
OracleCommunications Operations Monitor
Versions 3.4, 4.0
OracleHttp Server
Version 12.2.1.3.0
OracleSecure Global Desktop
Version 5.4
RedhatEnterprise Linux
Version 8.0
F5Big-Ip Access Policy Manager
from 13.1.0 through 13.1.3
from 14.0.0 through 14.1.2
from 15.0.0 through 15.0.1

Weakness classification

CWE-125CWE-190

References