CVE-2016-8619 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 87%

Affected Products (NVD)

Vendor	Product	Version
haxx	curl	𝑥 < 7.51.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

curl

bookworm	7.88.1-10+deb12u7 fixed
bookworm (security)	7.88.1-10+deb12u5 fixed
bullseye	7.74.0-1.3+deb11u13 fixed
bullseye (security)	7.74.0-1.3+deb11u11 fixed
sid	8.10.1-2 fixed
trixie	8.10.1-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

curl

precise	Fixed 7.22.0-3ubuntu4.17 released
trusty	Fixed 7.35.0-1ubuntu2.10 released
xenial	Fixed 7.47.0-1ubuntu2.2 released
yakkety	Fixed 7.50.1-1ubuntu1.1 released
zesty	Fixed 7.50.1-1ubuntu2 released

openSUSE / SLES Releases

openSUSE Product

Release

curl

suse enterprise desktop 15	7.60.0-1.1 fixed
suse enterprise desktop 15 SP1	7.60.0-3.17.1 fixed
suse enterprise desktop 15 SP2	7.66.0-2.59 fixed
suse enterprise desktop 15 SP3	7.66.0-4.14.1 fixed
suse enterprise desktop 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise desktop 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise desktop 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise desktop 15 SP7	8.6.0-150600.4.21.1 fixed
suse enterprise sap 12 SP1	7.37.0-31.1 fixed
suse enterprise sap 12 SP5	7.60.0-9.8 fixed
suse enterprise sap 15	7.60.0-1.1 fixed
suse enterprise sap 15 SP1	7.60.0-3.17.1 fixed
suse enterprise sap 15 SP2	7.66.0-2.59 fixed
suse enterprise sap 15 SP3	7.66.0-4.14.1 fixed
suse enterprise sap 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise sap 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise sap 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise sap 15 SP7	8.6.0-150600.4.21.1 fixed
suse enterprise server 12 SP1	7.37.0-31.1 fixed
suse enterprise server 12 SP5	7.60.0-9.8 fixed
suse enterprise server 15	7.60.0-1.1 fixed
suse enterprise server 15 SP1	7.60.0-3.17.1 fixed
suse enterprise server 15 SP2	7.66.0-2.59 fixed
suse enterprise server 15 SP3	7.66.0-4.14.1 fixed
suse enterprise server 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise server 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise server 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise server 15 SP7	8.6.0-150600.4.21.1 fixed

libcurl-devel

suse enterprise desktop 15	7.60.0-1.1 fixed
suse enterprise desktop 15 SP1	7.60.0-3.17.1 fixed
suse enterprise desktop 15 SP2	7.66.0-2.59 fixed
suse enterprise desktop 15 SP3	7.66.0-4.14.1 fixed
suse enterprise desktop 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise desktop 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise desktop 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise desktop 15 SP7	8.6.0-150600.4.21.1 fixed
suse enterprise sap 15	7.60.0-1.1 fixed
suse enterprise sap 15 SP1	7.60.0-3.17.1 fixed
suse enterprise sap 15 SP2	7.66.0-2.59 fixed
suse enterprise sap 15 SP3	7.66.0-4.14.1 fixed
suse enterprise sap 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise sap 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise sap 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise sap 15 SP7	8.6.0-150600.4.21.1 fixed
suse enterprise server 15	7.60.0-1.1 fixed
suse enterprise server 15 SP1	7.60.0-3.17.1 fixed
suse enterprise server 15 SP2	7.66.0-2.59 fixed
suse enterprise server 15 SP3	7.66.0-4.14.1 fixed
suse enterprise server 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise server 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise server 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise server 15 SP7	8.6.0-150600.4.21.1 fixed

libcurl4

suse enterprise desktop 15	7.60.0-1.1 fixed
suse enterprise desktop 15 SP1	7.60.0-3.17.1 fixed
suse enterprise desktop 15 SP2	7.66.0-2.59 fixed
suse enterprise desktop 15 SP3	7.66.0-4.14.1 fixed
suse enterprise desktop 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise desktop 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise desktop 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise desktop 15 SP7	8.6.0-150600.4.21.1 fixed
suse enterprise sap 12 SP1	7.37.0-31.1 fixed
suse enterprise sap 12 SP5	7.60.0-9.8 fixed
suse enterprise sap 15	7.60.0-1.1 fixed
suse enterprise sap 15 SP1	7.60.0-3.17.1 fixed
suse enterprise sap 15 SP2	7.66.0-2.59 fixed
suse enterprise sap 15 SP3	7.66.0-4.14.1 fixed
suse enterprise sap 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise sap 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise sap 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise sap 15 SP7	8.6.0-150600.4.21.1 fixed
suse enterprise server 12 SP1	7.37.0-31.1 fixed
suse enterprise server 12 SP5	7.60.0-9.8 fixed
suse enterprise server 15	7.60.0-1.1 fixed
suse enterprise server 15 SP1	7.60.0-3.17.1 fixed
suse enterprise server 15 SP2	7.66.0-2.59 fixed
suse enterprise server 15 SP3	7.66.0-4.14.1 fixed
suse enterprise server 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise server 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise server 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise server 15 SP7	8.6.0-150600.4.21.1 fixed

libcurl4-32bit

suse enterprise desktop 15	7.60.0-1.1 fixed
suse enterprise desktop 15 SP1	7.60.0-3.17.1 fixed
suse enterprise desktop 15 SP2	7.66.0-2.59 fixed
suse enterprise desktop 15 SP3	7.66.0-4.14.1 fixed
suse enterprise desktop 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise desktop 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise desktop 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise desktop 15 SP7	8.6.0-150600.4.21.1 fixed
suse enterprise sap 12 SP1	7.37.0-31.1 fixed
suse enterprise sap 12 SP5	7.60.0-9.8 fixed
suse enterprise sap 15	7.60.0-1.1 fixed
suse enterprise sap 15 SP1	7.60.0-3.17.1 fixed
suse enterprise sap 15 SP2	7.66.0-2.59 fixed
suse enterprise sap 15 SP3	7.66.0-4.14.1 fixed
suse enterprise sap 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise sap 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise sap 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise sap 15 SP7	8.6.0-150600.4.21.1 fixed
suse enterprise server 12 SP1	7.37.0-31.1 fixed
suse enterprise server 12 SP5	7.60.0-9.8 fixed
suse enterprise server 15	7.60.0-1.1 fixed
suse enterprise server 15 SP1	7.60.0-3.17.1 fixed
suse enterprise server 15 SP2	7.66.0-2.59 fixed
suse enterprise server 15 SP3	7.66.0-4.14.1 fixed
suse enterprise server 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise server 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise server 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise server 15 SP7	8.6.0-150600.4.21.1 fixed

Common Weakness Enumeration

CWE-416 - Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CWE-415 - Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

http://www.securityfocus.com/bid/94100

http://www.securitytracker.com/id/1037192

https://access.redhat.com/errata/RHSA-2018:2486

https://access.redhat.com/errata/RHSA-2018:3558

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8619

https://curl.haxx.se/CVE-2016-8619.patch

https://curl.haxx.se/docs/adv_20161102E.html

https://security.gentoo.org/glsa/201701-47

https://www.tenable.com/security/tns-2016-21

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

http://www.securityfocus.com/bid/94100

http://www.securitytracker.com/id/1037192

https://access.redhat.com/errata/RHSA-2018:2486

https://access.redhat.com/errata/RHSA-2018:3558

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8619

https://curl.haxx.se/CVE-2016-8619.patch

https://curl.haxx.se/docs/adv_20161102E.html

https://security.gentoo.org/glsa/201701-47

https://www.tenable.com/security/tns-2016-21