Fluid Attacks Database

Description

The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.16	curl	>=0 <7.53.1-r2	7.53.1-r2
alpine v3.13	curl	>=0 <7.53.1-r2	7.53.1-r2
alpine v3.17	curl	>=0 <7.53.1-r2	7.53.1-r2
alpine v3.21	curl	>=0 <7.53.1-r2	7.53.1-r2
alpine v3.9	curl	>=0 <7.53.1-r2	7.53.1-r2
alpine v3.10	curl	>=0 <7.53.1-r2	7.53.1-r2
alpine v3.11	curl	>=0 <7.53.1-r2	7.53.1-r2
debian 14	curl	>=0 <7.52.1-4	7.52.1-4
alpine v3.2	curl	>=0 <7.52.1-r1	7.52.1-r1
alpine v3.18	curl	>=0 <7.53.1-r2	7.53.1-r2

1-10 of 29

Aliases

1. CVE-2017-74072. NVD-2017-74073. OSV-ALPINE-2017-74074. OSV-2017-74075. OSV-DEBIAN-2017-74076. SECURITY-CVE-2017-74077. SECURITY-TRACKER-CVE-2017-7407

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.