CVE:CVE-2017-1000100
CNNVD:CNNVD-201708-672
Haxx curl和libcurl都是瑞典Haxx公司的产品。curl是一套利用URL语法在命令行下工作的文件传输工具。libcurl是一个免费、开源的客户端URL传输库。
Haxx curl/libcURL中存在基于堆的缓冲区溢出漏洞。攻击者可利用该漏洞诱使使用curl的客户端向远程服务器发送私人的内存内容。
solution:Upgrade haxx libcurl to a higher version than 7.15.0,7.15.1,7.15.2,7.15.3,7.15.4,7.15.5,7.16.0,7.16.1,7.16.2,7.16.3,7.16.4,7.17.0,7.17.1,7.18.0,7.18.1,7.18.2,7.19.0,7.19.1,7.19.2,7.19.3,7.19.4,7.19.5,7.19.6,7.19.7,7.20.0,7.20.1,7.21.0,7.21.1,7.21.2,7.21.3,7.21.4,7.21.5,7.21.6,7.21.7,7.22.0,7.23.0,7.23.1,7.24.0,7.25.0,7.26.0,7.27.0,7.28.0,7.28.1,7.29.0,7.30.0,7.31.0,7.32.0,7.33.0,7.34.0,7.35.0,7.36.0,7.37.0,7.37.1,7.38.0,7.39,7.40.0,7.41.0,7.42.0,7.42.1,7.43.0,7.44.0,7.45.0,7.46.0,7.47.0,7.47.1,7.48.0,7.49.0,7.49.1,7.50.0,7.50.1,7.50.2,7.50.3,7.51.0,7.52.0,7.52.1,7.53.0,7.53.1,7.54.0,7.54.1,and avoid the version 7.15.0,7.15.1,7.15.2,7.15.3,7.15.4,7.15.5,7.16.0,7.16.1,7.16.2,7.16.3,7.16.4,7.17.0,7.17.1,7.18.0,7.18.1,7.18.2,7.19.0,7.19.1,7.19.2,7.19.3,7.19.4,7.19.5,7.19.6,7.19.7,7.20.0,7.20.1,7.21.0,7.21.1,7.21.2,7.21.3,7.21.4,7.21.5,7.21.6,7.21.7,7.22.0,7.23.0,7.23.1,7.24.0,7.25.0,7.26.0,7.27.0,7.28.0,7.28.1,7.29.0,7.30.0,7.31.0,7.32.0,7.33.0,7.34.0,7.35.0,7.36.0,7.37.0,7.37.1,7.38.0,7.39,7.40.0,7.41.0,7.42.0,7.42.1,7.43.0,7.44.0,7.45.0,7.46.0,7.47.0,7.47.1,7.48.0,7.49.0,7.49.1,7.50.0,7.50.1,7.50.2,7.50.3,7.51.0,7.52.0,7.52.1,7.53.0,7.53.1,7.54.0,7.54.1