{"id":"CVE-2017-7407","details":"The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.","aliases":["CURL-CVE-2017-7407"],"modified":"2026-05-17T11:54:34.801873465Z","published":"2017-04-03T20:59:00.247Z","related":["SUSE-SU-2017:1042-1","SUSE-SU-2017:1043-1","SUSE-SU-2017:1117-1","SUSE-SU-2017:2312-1","SUSE-SU-2017:2699-1","SUSE-SU-2017:2700-1"],"database_specific":{},"references":[{"type":"ADVISORY","url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3558"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201709-14"},{"type":"FIX","url":"https://github.com/curl/curl/commit/1890d59905414ab84a35892b2e45833654aa5c13"}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}