{"id":"CURL-CVE-2017-1000099","summary":"FILE buffer read out of bounds","details":"When asking to get a file from a file:// URL, libcurl provides a feature that\noutputs meta-data about the file using HTTP-like headers.\n\nThe code doing this would send the wrong buffer to the user (stdout or the\napplication's provide callback), which could lead to other private data from\nthe heap to get inadvertently displayed.\n\nThe wrong buffer was an uninitialized memory area allocated on the heap and if\nit turned out to not contain any zero byte, it would continue and display the\ndata following that buffer in memory.","aliases":["CVE-2017-1000099"],"modified":"2026-04-25T20:30:34.558206Z","published":"2017-08-09T08:00:00Z","database_specific":{"severity":"Medium","package":"curl","affects":"both","CWE":{"id":"CWE-170","desc":"Improper Null Termination"},"last_affected":"7.54.1","URL":"https://curl.se/docs/CVE-2017-1000099.json","www":"https://curl.se/docs/CVE-2017-1000099.html"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"7.54.1"},{"fixed":"7.55.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"7c312f84ea930d89c0f0f774b50032c4f9ae30e4"},{"fixed":"c9332fa5e84f24da300b42b1a931ade929d3e27d"}]}],"versions":["7.54.1"],"database_specific":{"vanir_signatures_modified":"2026-04-25T20:30:34Z","source":"https://curl.se/docs/CURL-CVE-2017-1000099.json","vanir_signatures":[{"deprecated":false,"id":"CURL-CVE-2017-1000099-da99fdcd","source":"https://github.com/curl/curl.git/commit/c9332fa5e84f24da300b42b1a931ade929d3e27d","target":{"file":"lib/file.c"},"signature_type":"Line","digest":{"line_hashes":["46911169171007843427348534250583416736","107040883296720270543601030486367496640","179315136899822449107474138076323869367","295178335870434496992950770330948870422"],"threshold":0.9},"signature_version":"v1"}]}}],"schema_version":"1.7.5","credits":[{"name":"Even Rouault","type":"FINDER"},{"name":"Even Rouault","type":"REMEDIATION_DEVELOPER"}]}