Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
CURL-CVE-2017-7407
No affected components available
There were two bugs in curl's parser for the command line option --write-out
(or -w for short) that would skip the end of string zero byte if the string
ended in a % (percent) or \ (backslash), and it would read beyond that
buffer in the heap memory and it could then potentially output pieces of that
memory to the terminal or the target file etc.
The curl security team did not report this as a security vulnerability due to the minimal risk: the memory this would output comes from the process the user itself invokes and that runs with the same privileges as the user. We could not come up with a likely scenario where this could leak other users' data or memory contents.
An external party registered this as a CVE with MITRE and we feel a
responsibility to clarify what this flaw is about. The CVE-2017-7407 issue is
specifically only about the % part of this flaw.
This flaw only exists in the command line tool.
Measures severity based on intrinsic characteristics of the vulnerability, independent of environment.
No exploitation activity has been observed at this time. Continue routine monitoring.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard