Wind River Support Network

HomeDefectsLIN1018-3561
Fixed

LIN1018-3561 : Security Advisory - curl - CVE-2018-16890

Created: Feb 14, 2019    Updated: Apr 22, 2022
Resolved Date: Feb 20, 2019
Found In Version: unknown
Fix Version: 10.18.44.4
Severity: Standard
Applicable for: Wind River Linux LTS 18
Component/s: Userspace

Description

libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.

https://nvd.nist.gov/vuln/detail/CVE-2018-16890

CVEs


Live chat
Online