CVE-2016-7167 Integer overflow in n/a
Integer overflows in libcurl escape functions allow attackers to trigger heap-based buffer overflows via crafted strings, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7167?
CVE-2016-7167 is a critical vulnerability in Fedoraproject Fedora, published on 7 Oct 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.
Weakness: CWE-190
Which versions are affected by CVE-2016-7167?
It affects 2 products.
Linux distribution packages (16)
curl Red Hat:enterprise_linux:7::client | All versions | 0:7.29.0-42.el7 |
curl-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:7.29.0-42.el7 |
libcurl Red Hat:enterprise_linux:7::client | All versions | 0:7.29.0-42.el7 |
libcurl-devel Red Hat:enterprise_linux:7::client | All versions | 0:7.29.0-42.el7 |
curl Red Hat:enterprise_linux:7::computenode | All versions | 0:7.29.0-42.el7 |
curl-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:7.29.0-42.el7 |
libcurl Red Hat:enterprise_linux:7::computenode | All versions | 0:7.29.0-42.el7 |
libcurl-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:7.29.0-42.el7 |
curl Red Hat:enterprise_linux:7::server | All versions | 0:7.29.0-42.el7 |
curl-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:7.29.0-42.el7 |
libcurl Red Hat:enterprise_linux:7::server | All versions | 0:7.29.0-42.el7 |
libcurl-devel Red Hat:enterprise_linux:7::server | All versions | 0:7.29.0-42.el7 |
curl Red Hat:enterprise_linux:7::workstation | All versions | 0:7.29.0-42.el7 |
curl-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:7.29.0-42.el7 |
libcurl Red Hat:enterprise_linux:7::workstation | All versions | 0:7.29.0-42.el7 |
libcurl-devel Red Hat:enterprise_linux:7::workstation | All versions | 0:7.29.0-42.el7 |
Products include Fedoraproject Fedora, Haxx Libcurl.
How do I fix CVE-2016-7167?
Upgrade to a fixed version.
Is CVE-2016-7167 being exploited?
There is no known exploitation of CVE-2016-7167 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2016-7167, CLEANSTART-2026-IQ08712, CURL-CVE-2016-7167, DEBIAN-CVE-2016-7167, DLA-625-1, GHSA-679j-c6m7-q7pr and 3 more.