CVE-2016-8622 in macOS

Summary

The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Responsible

Red Hat, Inc.

Reservation

10/12/2016

Disclosure

07/31/2018

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
94375	Apple macOS curl out-of-bounds write	787	Not defined	Official fix	CVE-2016-8622
93258	cURL/libcURL curl_easy_unescape out-of-bounds write	787	Not defined	Official fix	CVE-2016-8622

Sources

• MITRE
• NVD
• CVE Details