Critical · published September 16, 2019
🚨 A double-free vulnerability lurks in cURL’s FTP-Kerberos code, and it’s impacting versions from 7.52.0 to 7.65.3! 🔥 Think of it like tossing a half-eaten sandwich in the trash and then trying to eat it again — it’s a messy recipe for disaster! This double-free flaw allows the system to try and use the same memory space twice, leading to potential chaos. An attacker could potentially exploit this flaw to cause a crash, leading to a complete denial of service. Imagine your server just going dark at the most critical moment; it could have devastating consequences for your operations!
Think of it like tossing a half-eaten sandwich in the trash and then trying to eat it again — it’s a messy recipe for disaster! This double-free flaw allows the system to try and use the same memory space twice, leading to potential chaos. This vulnerability occurs when cURL’s FTP-Kerberos code attempts to free the same memory chunk twice without proper checks, which can be exploited to manipulate memory and potentially execute arbitrary code.
An attacker could potentially exploit this flaw to cause a crash, leading to a complete denial of service. Imagine your server just going dark at the most critical moment; it could have devastating consequences for your operations! To protect your applications, update cURL to version 7.66.0 or later immediately. Additionally, ensure you regularly audit your code and dependencies to catch these vulnerabilities early! You've got this! By taking action now, you're one step closer to securing your systems! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| haxx/curl | ≥ 7.52.0, ≤ 7.65.3 | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| netapp/cloud_backup | all versions | — |
| netapp/steelstore | all versions | — |
| netapp/solidfire_baseboard_management_controller_firmware | all versions | — |
| oracle/communications_operations_monitor | all versions | — |
| oracle/communications_operations_monitor | all versions | — |
| oracle/communications_operations_monitor | all versions | — |
| oracle/communications_operations_monitor | all versions | — |
| oracle/communications_operations_monitor | all versions | — |
| oracle/communications_session_border_controller | all versions | — |
| oracle/communications_session_border_controller | all versions | — |
| oracle/enterprise_manager_ops_center | all versions | — |
| oracle/enterprise_manager_ops_center | all versions | — |
| oracle/mysql_server | ≥ 5.7.0, ≤ 5.7.28 | — |
| oracle/mysql_server | ≥ 8.0.0, ≤ 8.0.18 | — |
| oracle/oss_support_tools | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| opensuse/leap | all versions | — |
| opensuse/leap | all versions | — |