CVE-2016-4606 Code injection in curl
Remote or local attackers can execute arbitrary code, gain sensitive information, and cause denial-of-service in curl on Apple OS X.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-4606?
CVE-2016-4606 is a critical code injection vulnerability in Haxx Curl, published on 21 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
Which versions are affected by CVE-2016-4606?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2016-4606?
No fix has been published for CVE-2016-4606 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2016-4606 being exploited?
There is no known exploitation of CVE-2016-4606 in the wild and no public exploit code.
Other vulnerabilities in Haxx Curl
Sources
Also known as GHSA-2fx2-v8hh-86v7.