CVE-2013-2174
Fixed in a distro release EPSS 10%
Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.
Products: haxx curl, haxx libcurl, canonical ubuntu_linux, opensuse, redhat enterprise_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | curl | 7.31.0-1 |
| Debian 13 | curl | 7.31.0-1 |
| Debian 14 | curl | 7.31.0-1 |
| Debian 6.0 | curl | 7.21.0-2.1+squeeze4 |
| Debian 7 | curl | 7.26.0-1+wheezy3 |
| Red Hat Enterprise Linux 5 | curl | 0:7.15.5-17.el5_9 |
| Red Hat Enterprise Linux 5 | curl-debuginfo | 0:7.15.5-17.el5_9 |
| Red Hat Enterprise Linux 5 | curl-devel | 0:7.15.5-17.el5_9 |
| Red Hat Enterprise Linux 6 | curl | 0:7.19.7-37.el6_4 |
| Red Hat Enterprise Linux 6 | curl-debuginfo | 0:7.19.7-37.el6_4 |
| Red Hat Enterprise Linux 6 | libcurl | 0:7.19.7-37.el6_4 |
| Red Hat Enterprise Linux 6 | libcurl-devel | 0:7.19.7-37.el6_4 |
| openSUSE Tumbleweed | curl | 7.51.0-1.1 |