CVE-2017-8816

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	curl and libcurl before 7.57.0	curl and libcurl before 7.57.0

References

http://security.cucumberlinux.com/security/details.php?id=161Third Party Advisory
http://www.securityfocus.com/bid/101998Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039896Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040608
https://access.redhat.com/errata/RHSA-2018:3558
https://curl.haxx.se/docs/adv_2017-12e7.htmlMitigation, Vendor Advisory
https://security.gentoo.org/glsa/201712-04Third Party Advisory
https://www.debian.org/security/2017/dsa-4051Third Party Advisory
http://security.cucumberlinux.com/security/details.php?id=161Third Party Advisory
http://www.securityfocus.com/bid/101998Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039896Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040608
https://access.redhat.com/errata/RHSA-2018:3558
https://curl.haxx.se/docs/adv_2017-12e7.htmlMitigation, Vendor Advisory
https://security.gentoo.org/glsa/201712-04Third Party Advisory
https://www.debian.org/security/2017/dsa-4051Third Party Advisory

Timeline

Published: Nov 29, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-88179.8The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and app CVE-2017-88189.8curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash)CVE-2017-88197.5In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the rep CVE-2017-88207.5In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, remote CVE-2017-88217.5In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, an atta CVE-2017-88223.7In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, relays CVE-2017-88238.1In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there i CVE-2017-88247.8The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial CVE-2017-88257.5A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A CVE-2017-88267.8FastStone Image Viewer 6.2 has a "User Mode Write AV" issue, possibly related to the jpeg_mem_term function in jmemnobs.c in libjpeg. This i CVE-2017-88279.1forgotpassword.php in GeniXCMS 1.0.2 lacks a rate limit, which might allow remote attackers to cause a denial of service (login inability) o CVE-2017-88297.8Deserialization vulnerability in lintian through 2.5.50.3 allows attackers to trigger code execution by requesting a review of a source pack