CVE-2016-9953 Information disclosure in n/a
Remote attackers can cause crashes or leak sensitive information via wildcard certificates in libcurl's Schannel backend on Windows CE.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-9953?
CVE-2016-9953 is a critical vulnerability in Haxx Curl, published on 12 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly have unspecified other impact via a wildcard certificate name, which triggers an out-of-bounds read.
Weakness: CWE-125
Which versions are affected by CVE-2016-9953?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2016-9953?
Upgrade to a fixed version.
Is CVE-2016-9953 being exploited?
There is no known exploitation of CVE-2016-9953 in the wild and no public exploit code.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2016-9953, CURL-CVE-2016-9953, GHSA-72rm-6rfp-xgr9.