curl: IMAP FETCH response out of bounds read

🗓️ 16 Aug 2018 16:06:16Reported by RedHatType

Buffer overrun flaw in libcurl IMAP handler may disclose data or crash with a malicious IMAP server.

Reporter	Title	Published	Views	Family All 130
FreeBSD	cURL -- out of bounds read	23 Oct 201700:00	–	freebsd
IBM Security Bulletins	IBM Security Network Protection / IBM QRadar Network Security / XGS Technote Index	31 Jan 202100:10	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Open Source cURL Libcurl affects IBM PureApplication. (CVE-2017-1000257)	15 Jun 201807:08	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in curl affects PowerKVM	18 Jun 201801:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL/libcurl affect Intel® Manycore Platform Software Stack (Intel® MPSS) for Linux and Windows	31 Jan 201902:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL component shipped with IBM Rational ClearCase (CVE-2017-1000100, CVE-2017-1000254, CVE-2017-1000257)	10 Jul 201808:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Access Manager Appliance is affected by a cURL vulnerability (CVE-2017-1000257)	21 Aug 201819:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Security is affected by a denial of service vulnerability in cURL (CVE-2017-1000257)	16 Jun 201822:04	–	ibm
Tenable Nessus	Amazon Linux 2 : curl (ALAS-2019-1162)	19 Feb 201900:00	–	nessus
Tenable Nessus	Amazon Linux AMI : curl (ALAS-2017-922)	21 Nov 201700:00	–	nessus

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2017-1000257
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
curl	www.curl.haxx.se/docs/adv_20171023.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2017-1000257
cve	www.cve.org/CVERecord

30 Jun 2026 11:42Current

7.4High risk

Vulners AI Score7.4

CVSS 26.4

CVSS 39.1

CVSS 3.19.1

EPSS0.06224

SSVC