SB2017040716 - Fedora 26 update for curl
Published: April 7, 2017 Updated: April 24, 2025
Security Bulletin ID
SB2017040716
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Physical access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Buffer overflow (CVE-ID: CVE-2017-7407)
The vulnerability allows a local non-authenticated attacker to gain access to sensitive information.
The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.
Remediation
Install update from vendor's website.