CVE-2018-16840

Name of the Vulnerable Software and Affected Versions curl versions 7.59.0 through 7.61.1

Description A heap use-after-free flaw was found in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the Curl close() function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.

Recommendations For curl versions 7.59.0 through 7.61.1, consider updating to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting the use of the Curl close() function until a patch is available.