curl: IMAP FETCH response out of bounds read

🗓️ 27 Nov 2017 14:51:12Reported by RedHatType

Buffer overrun in the curl mail handler may allow disclosure or crash when connecting to a malicious server.

Reporter	Title	Published	Views	Family All 130
FreeBSD	cURL -- out of bounds read	23 Oct 201700:00	–	freebsd
IBM Security Bulletins	IBM Security Network Protection / IBM QRadar Network Security / XGS Technote Index	31 Jan 202100:10	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Open Source cURL Libcurl affects IBM PureApplication. (CVE-2017-1000257)	15 Jun 201807:08	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in curl affects PowerKVM	18 Jun 201801:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL/libcurl affect Intel® Manycore Platform Software Stack (Intel® MPSS) for Linux and Windows	31 Jan 201902:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL component shipped with IBM Rational ClearCase (CVE-2017-1000100, CVE-2017-1000254, CVE-2017-1000257)	10 Jul 201808:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Access Manager Appliance is affected by a cURL vulnerability (CVE-2017-1000257)	21 Aug 201819:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Security is affected by a denial of service vulnerability in cURL (CVE-2017-1000257)	16 Jun 201822:04	–	ibm
Tenable Nessus	Amazon Linux 2 : curl (ALAS-2019-1162)	19 Feb 201900:00	–	nessus
Tenable Nessus	Amazon Linux AMI : curl (ALAS-2017-922)	21 Nov 201700:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	7	aarch64	curl	0:7.29.0-42.el7_4.1	curl-0:7.29.0-42.el7_4.1.aarch64.rpm
Red Hat Enterprise Linux	7	ppc64	curl	0:7.29.0-42.el7_4.1	curl-0:7.29.0-42.el7_4.1.ppc64.rpm
Red Hat Enterprise Linux	7	ppc64le	curl	0:7.29.0-42.el7_4.1	curl-0:7.29.0-42.el7_4.1.ppc64le.rpm
Red Hat Enterprise Linux	7	s390x	curl	0:7.29.0-42.el7_4.1	curl-0:7.29.0-42.el7_4.1.s390x.rpm
Red Hat Enterprise Linux	7	x86_64	curl	0:7.29.0-42.el7_4.1	curl-0:7.29.0-42.el7_4.1.x86_64.rpm
Red Hat Enterprise Linux	7	aarch64	curl-debuginfo	0:7.29.0-42.el7_4.1	curl-debuginfo-0:7.29.0-42.el7_4.1.aarch64.rpm
Red Hat Enterprise Linux	7	ppc	curl-debuginfo	0:7.29.0-42.el7_4.1	curl-debuginfo-0:7.29.0-42.el7_4.1.ppc.rpm
Red Hat Enterprise Linux	7	ppc64	curl-debuginfo	0:7.29.0-42.el7_4.1	curl-debuginfo-0:7.29.0-42.el7_4.1.ppc64.rpm
Red Hat Enterprise Linux	7	ppc64le	curl-debuginfo	0:7.29.0-42.el7_4.1	curl-debuginfo-0:7.29.0-42.el7_4.1.ppc64le.rpm
Red Hat Enterprise Linux	7	s390	curl-debuginfo	0:7.29.0-42.el7_4.1	curl-debuginfo-0:7.29.0-42.el7_4.1.s390.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2017-1000257
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
curl	www.curl.haxx.se/docs/adv_20171023.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2017-1000257
cve	www.cve.org/CVERecord

28 Jun 2026 12:11Current

7.4High risk

Vulners AI Score7.4

CVSS 26.4

CVSS 39.1

CVSS 3.19.1

EPSS0.06224

SSVC