Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.
CVSS Details
- CVSS 3.1 Base Score: 5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libcurlUpgrade curlUpgrade curl-develUpgrade libcurl-devel | Dec 1, 2016 | Jul 31, 2013 |
| Debian | — | Upgrade curl | Jul 30, 2024 | Jul 31, 2013 |
| Freebsd | — | Upgrade curl | Dec 10, 2025 | Jun 23, 2013 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Oct 30, 2017 | Jul 31, 2013 |
| Oracle Solaris | — | Upgrade web/curl to version 7.21.2-0.175.1.18.0.3.0 on Solaris 11.1 | May 29, 2017 | Jul 31, 2013 |
| Oracle_linux | — | Upgrade libcurlUpgrade curlUpgrade libcurl-develUpgrade curl-devel | Oct 16, 2024 | Jul 31, 2013 |
| Suse | — | Upgrade curlUpgrade compat-curl2-32bitUpgrade libcurl-develUpgrade compat-curl2-x86Upgrade curl-32bitUpgrade curl-develUpgrade compat-curl2-64bitUpgrade curl-x86Upgrade compat-curl2Upgrade libcurl4Upgrade libcurl4-x86Upgrade libcurl4-32bitUpgrade sle-sdk-releaseUpgrade curl-64bit | Dec 12, 2013 | Jul 31, 2013 |
| Ubuntu | — | Upgrade libcurl3-gnutlsUpgrade libcurl3Upgrade libcurl3-nss | Nov 8, 2024 | Jul 31, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub