K22052524 : cURL and libcurl vulnerability CVE-2018-1000120

Security Advisory Description

A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse. (CVE-2018-1000120)

Impact

libcurl does not safely parse FTP URLs when using the CURLOPT_FTP_FILEMETHOD method. By providing a specially crafted FTP URL to an application using libcurl, an attacker can write a NULL byte at an arbitrary location, causing the system to stop responding or other unspecified behavior.