CoreCVE
Back

CRITICAL

curl: IMAP FETCH response out of bounds read

Published Oct 31, 2017

Description

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.

Affected products

Remediation

Red Hat mitigation

Switch off IMAP in `CURLOPT_PROTOCOLS`

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-125

Out-of-bounds Read

References (13)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Oct 31, 2017
Updated Apr 15, 2026
Reserved Oct 31, 2017
Link CVE-2017-1000257
CISA Vulnrichment
Updated Apr 15, 2026
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2017-1000257
Red Hat
Severity Moderate
Public date Oct 23, 2017
Links CVE-2017-1000257 - Bugzilla
ENISA EUVD
Assigner mitre
Published Oct 31, 2017
Updated Apr 15, 2026
Exploited since n/a
Link EUVD-2017-1518
EUVD-2017-1518