libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated.
This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mecabUpgrade mysql-serverUpgrade mecab-develUpgrade mysql-develUpgrade mysqlUpgrade mysql-testUpgrade mysql-errmsgUpgrade mecab-ipadic-EUCJPUpgrade mysql-commonUpgrade mysql-libsUpgrade mecab-ipadic | Feb 21, 2025 | Jul 31, 2024 |
| Alpine Linux | — | Upgrade curl | Oct 1, 2024 | Jul 31, 2024 |
| Amazon Linux Ami 2 | — | Upgrade ecs-service-connect-agent | Nov 14, 2024 | Jul 31, 2024 |
| Amazon_linux_2023 | — | Upgrade ecs-service-connect-agent | Feb 17, 2025 | Jul 31, 2024 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Dec 15, 2025 | Dec 15, 2025 |
| Debian | — | Upgrade curl | Sep 2, 2024 | Jul 31, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libcurlUpgrade curl | Nov 11, 2024 | Jul 31, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade curlUpgrade libcurl | Oct 9, 2024 | Jul 31, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade curlUpgrade libcurl | Nov 5, 2024 | Jul 31, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade curlUpgrade libcurl | Nov 11, 2024 | Jul 31, 2024 |
| Oracle Missing Cpu Oct 2024 | — | Apply the October 2024 Critical Patch Update (CPU) for Oracle Database | Oct 18, 2024 | Jul 31, 2024 |
| Oracle Mysql | — | Upgrade to MySQL version 8.4.3Upgrade to MySQL version 9.1.0Upgrade to MySQL version 8.0.40 | Oct 23, 2024 | Jul 31, 2024 |
| Oracle_linux | — | Upgrade mecab-ipadicUpgrade mysql-commonUpgrade mysql-libsUpgrade mecab-ipadic-EUCJPUpgrade mysql-errmsgUpgrade mysql-serverUpgrade mecabUpgrade mecab-develUpgrade mysql-testUpgrade mysqlUpgrade mysql-devel | Feb 25, 2025 | Jul 31, 2024 |
| Redhat_linux | — | Upgrade mysql-debugsourceUpgrade mysql-devel-debuginfoUpgrade mecab-debuginfoUpgrade mysql-commonUpgrade mecabUpgrade mysqlUpgrade mysql-testUpgrade mecab-ipadicNo solution existsUpgrade mysql-errmsgUpgrade mysql-libsUpgrade mecab-ipadic-EUCJPUpgrade mysql-server-debuginfoUpgrade mysql-develUpgrade mecab-develUpgrade mysql-debuginfoUpgrade mysql-test-debuginfoUpgrade mysql-libs-debuginfoUpgrade mecab-debugsourceUpgrade mysql-server | Feb 20, 2025 | Jul 31, 2024 |
| Rocky_linux | — | Upgrade mysql-test-debuginfoUpgrade mysql-develUpgrade mecab-debuginfoUpgrade mysql-testUpgrade mecab-ipadic-EUCJPUpgrade mysql-serverUpgrade mysql-libsUpgrade mecab-ipadicUpgrade mysqlUpgrade mysql-debugsourceUpgrade mysql-devel-debuginfoUpgrade mecab-develUpgrade mysql-libs-debuginfoUpgrade mysql-errmsgUpgrade mecabUpgrade mysql-debuginfoUpgrade mysql-commonUpgrade mysql-server-debuginfoUpgrade mecab-debugsource | Feb 27, 2025 | Jul 31, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.10Upgrade Splunk Enterprise to version 9.3.5Upgrade Splunk Enterprise to version 9.2.7Upgrade Splunk Enterprise to version 9.4.3 | Jul 30, 2026 | Jul 31, 2024 |
| Suse | — | Upgrade libcurl-develUpgrade curl-zsh-completionUpgrade libcurl4Upgrade curlUpgrade libcurl-devel-docUpgrade libcurl-mini4Upgrade libcurl4-32bitUpgrade libcurl-devel-32bit | Aug 7, 2024 | Jul 31, 2024 |
| Ubuntu | — | Upgrade curlUpgrade libcurl4t64Upgrade libcurl3t64-gnutlsUpgrade libcurl3-gnutlsUpgrade curl (Ubuntu Pro)Upgrade libcurl3-gnutls (Ubuntu Pro)Upgrade libcurl3-nss (Ubuntu Pro)Upgrade libcurl3-nssUpgrade libcurl3 (Ubuntu Pro)Upgrade libcurl4 (Ubuntu Pro)Upgrade libcurl4 | Aug 6, 2024 | Jul 31, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 31, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub