Home

CVE-2016-9586

Description

curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurls implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.

Risk Information

Base Score
8.1
MODERATE
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.891

Associated Vulnerability

VulnerabilityOS Platform
Vulnerability CVE-2016-9586,CVE-2016-9952,CVE-2016-9953 are affected in Curl For Windows 7.51.0Windows
Multiple Vulnerabilities are affected in Curl For Windows 7.51.0Windows
Vulnerabilities CVE-2016-9586,CVE-2016-9952,CVE-2016-9953 are fixed in Curl For Windows 7.52.0Windows
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) curl_7.47.0-1ubuntu2.3_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) curl_7.47.0-1ubuntu2.3_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) curl_7.52.1-4ubuntu1.2_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) curl_7.52.1-4ubuntu1.2_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) curl_7.35.0-1ubuntu2.11_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) curl_7.35.0-1ubuntu2.11_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3_7.47.0-1ubuntu2.3_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3_7.47.0-1ubuntu2.3_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3_7.52.1-4ubuntu1.2_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3_7.52.1-4ubuntu1.2_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3_7.35.0-1ubuntu2.11_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3_7.35.0-1ubuntu2.11_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-nss_7.47.0-1ubuntu2.3_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-nss_7.47.0-1ubuntu2.3_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-nss_7.52.1-4ubuntu1.2_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-nss_7.52.1-4ubuntu1.2_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-nss_7.35.0-1ubuntu2.11_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-nss_7.35.0-1ubuntu2.11_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-gnutls_7.47.0-1ubuntu2.3_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-gnutls_7.47.0-1ubuntu2.3_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-gnutls_7.52.1-4ubuntu1.2_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-gnutls_7.52.1-4ubuntu1.2_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-gnutls_7.35.0-1ubuntu2.11_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-gnutls_7.35.0-1ubuntu2.11_amd64.debLinux
SUSE-SU-2017:1042-1(SUSE Linux Enterprise Desktop 12-SP1 ) curl-7.37.0-36.1.x86_64.rpmLinux
SUSE-SU-2017:1042-1(SUSE Linux Enterprise Desktop 12-SP1 ) curl-debuginfo-7.37.0-36.1.x86_64.rpmLinux
SUSE-SU-2017:1042-1(SUSE Linux Enterprise Desktop 12-SP1 ) curl-debugsource-7.37.0-36.1.x86_64.rpmLinux
SUSE-SU-2017:1042-1(SUSE Linux Enterprise Desktop 12-SP1 ) libcurl4-7.37.0-36.1.x86_64.rpmLinux
SUSE-SU-2017:1042-1(SUSE Linux Enterprise Desktop 12-SP1 ) libcurl4-32bit-7.37.0-36.1.x86_64.rpmLinux
SUSE-SU-2017:1042-1(SUSE Linux Enterprise Desktop 12-SP1 ) libcurl4-debuginfo-7.37.0-36.1.x86_64.rpmLinux
SUSE-SU-2017:1042-1(SUSE Linux Enterprise Desktop 12-SP1 ) libcurl4-debuginfo-32bit-7.37.0-36.1.x86_64.rpmLinux
CVE-2016-9586NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234