CVE-2017-8816

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.

Score

CVSS 3.1 9.8 Critical

Status

Modified - security@debian.org

Published

2017-11-29

Last modified

2026-04-15

Weaknesses

CWE-190

Affected products

• Debian Linux (Debian)
• Curl (Haxx)
• Libcurl (Haxx)

References

• http://security.cucumberlinux.com/security/details.php?id=161
• http://www.securityfocus.com/bid/101998
• http://www.securitytracker.com/id/1039896
• http://www.securitytracker.com/id/1040608
• https://access.redhat.com/errata/RHSA-2018:3558
• https://curl.haxx.se/docs/adv_2017-12e7.html
• https://security.gentoo.org/glsa/201712-04
• https://www.debian.org/security/2017/dsa-4051