Max Dymond

Name of the Vulnerable Software and Affected Versions: curl versions 7.20.0 through 7.59.0 Description: The issue is related to a buffer over-read vulnerability that can result in a denial of service. This occurs when curl is tricked into reading data beyond the end of a heap-based buffer used to store downloaded RTSP content. The vulnerability is exploited when servers send RTSP responses back to curl, and the data is parsed to separate it into headers. The `Curl http readwrite headers()` function may leave a pointer pointing into the buffer instead of to the start of the buffer, leading to an out-of-buffer read when code assumes that pointer points to a full buffer size worth of memory to use. This could potentially lead to information leakage but most likely a crash or denial of service for applications if a server triggers this flaw. Recommendations: For curl versions 7.20.0 through 7.59.0, update to version 7.60.0 or later to resolve the issue. As a temporary workaround, consider restricting access to RTSP content until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: curl versions 7.20.0 through 7.58.0 Description: A buffer over-read issue exists in the RTSP+RTP handling code, allowing an attacker to cause a denial of service or information leakage. When transferring an RTSP URL, the software can calculate a wrong data length to copy from the read buffer, leading to a `memcpy()` call that copies data from the heap following the buffer. This could result in information leakage or a denial of service for the application if the server offering the RTSP data can trigger this issue. Recommendations: For curl versions 7.20.0 through 7.58.0, update to a version outside of this range to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcurl versions prior to 7.56.0 **Description** The issue is related to a flaw in the string parser for directory names when libcurl connects to an FTP server. If the server responds with a 257 response containing the path without a closing double quote, libcurl may not add a trailing null byte to the buffer holding the name. This could lead to libcurl reading beyond the allocated heap buffer and crashing or wrongly accessing data beyond the buffer. A malicious server could exploit this fact, potentially causing a segfault. The issue was introduced in 2005 and remained undiscovered for a long time, suggesting that malformed PWD responses are rare in benign servers. There is no known exploit of this flaw. **Recommendations** For libcurl versions prior to 7.56.0, consider updating to version 7.56.0 or later, which always zero terminates the string and rejects it if not terminated properly with a final double quote. As a temporary workaround, consider restricting access to FTP servers that may send malformed PWD responses to minimize the risk of exploitation. Avoid using libcurl to connect to untrusted FTP servers until the issue is resolved.