curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded content. When servers send RTSP responses back to curl, the data starts out with a set of headers. curl parses that data to separate it into a number of headers to deal with those appropriately and to find the end of the headers that signal the start of the "body" part. The function that splits up the response into headers is called `Curl_http_readwrite_headers()` and in situations where it can't find a single header in the buffer, it might end up leaving a pointer pointing into the buffer instead of to the start of the buffer which then later on may lead to an out of buffer read when code assumes that pointer points to a full buffer size worth of memory to use. This could potentially lead to information leakage but most likely a crash/denial of service for applications if a server triggers this flaw. Introduced by following patches: https://github.com/curl/curl/commit/b2ef79ef3d47b37 https://github.com/curl/curl/commit/bc4582b68a673d3 Affected versions: curl 7.20.0 to and including curl 7.59.0 Not affected versions: curl < 7.20.0 and curl >= 7.60.0
Created attachment 1432530 [details] Upstream patch
Acknowledgments: Name: the Curl project Upstream: the OSS-Fuzz project
External References: https://curl.haxx.se/docs/adv_2018-b138.html
Created curl tracking bugs for this issue: Affects: fedora-all [bug 1578683]
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2018:3157 https://access.redhat.com/errata/RHSA-2018:3157
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2018:3558 https://access.redhat.com/errata/RHSA-2018:3558
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.5 Extended Update Support Via RHSA-2020:0544 https://access.redhat.com/errata/RHSA-2020:0544
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.4 Advanced Update Support Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions Red Hat Enterprise Linux 7.4 Telco Extended Update Support Via RHSA-2020:0594 https://access.redhat.com/errata/RHSA-2020:0594