Out-of-Bounds Read

2024-07-3009:26:03

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

libcurl.so

out-of-bounds read

url api

macidn idn backend

stack contents

sensitive information

software

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

35.1%

JSON

libcurl.so is vulnerable to an Out-of-Bounds Read. The vulnerability is due to a flaw in the URL API function curl_url_get() when using the macidn IDN backend. It arises from the function filling the provided buffer exactly without null-terminating the string. Attackers can exploit this to read stack contents, potentially leaking sensitive information.