CVE catalog

CVE-2017-8816

curl: CVE-2017-8816

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
8.52% · Oct 25, 2026

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancurlsid8.23.0-1fixed
Debiancurlforky8.22.0-1fixed
Debiancurltrixie8.14.1-2+deb13u5fixed
Debiancurltrixie-security8.14.1-2+deb13u7fixed
Debiancurlbookworm7.88.1-10+deb12u15fixed
Debiancurlbookworm-security7.88.1-10+deb12u5fixed
Alpinecurl3.107.57.0-r0fixed
Alpinecurl3.117.57.0-r0fixed
Alpinecurl3.127.57.0-r0fixed
Alpinecurl3.137.57.0-r0fixed
Alpinecurl3.147.57.0-r0fixed
Alpinecurl3.157.57.0-r0fixed
Alpinecurl3.167.57.0-r0fixed
Alpinecurl3.177.57.0-r0fixed
Alpinecurl3.187.57.0-r0fixed
Alpinecurl3.197.57.0-r0fixed
Alpinecurl3.207.57.0-r0fixed
Alpinecurl3.217.57.0-r0fixed
Alpinecurl3.227.57.0-r0fixed
Alpinecurl3.237.57.0-r0fixed
Alpinecurl3.247.57.0-r0fixed
Alpinecurl3.47.57.0-r0fixed
Alpinecurl3.57.57.0-r0fixed
Alpinecurl3.67.57.0-r0fixed
Alpinecurl3.77.57.0-r0fixed
Alpinecurl3.87.57.0-r0fixed
Alpinecurl3.97.57.0-r0fixed
Ubuntucurl14.047.32.0-1ubuntu1vulnerable
Ubuntucurl14.047.33.0-1ubuntu1vulnerable
Ubuntucurl14.047.34.0-1ubuntu1vulnerable
Ubuntucurl14.047.35.0-1ubuntu1vulnerable
Ubuntucurl14.047.35.0-1ubuntu2vulnerable
Ubuntucurl14.047.35.0-1ubuntu2.1vulnerable
Ubuntucurl14.047.35.0-1ubuntu2.2vulnerable
Ubuntucurl14.047.35.0-1ubuntu2.3vulnerable
Ubuntucurl14.047.35.0-1ubuntu2.5vulnerable
Ubuntucurl14.047.35.0-1ubuntu2.6vulnerable
Ubuntucurl14.047.35.0-1ubuntu2.7vulnerable
Ubuntucurl14.047.35.0-1ubuntu2.8vulnerable
Ubuntucurl14.047.35.0-1ubuntu2.9vulnerable
Ubuntucurl14.047.35.0-1ubuntu2.10vulnerable
Ubuntucurl14.047.35.0-1ubuntu2.11vulnerable
Ubuntucurl14.047.35.0-1ubuntu2.12vulnerable
Ubuntucurl14.047.35.0-1ubuntu2.13fixed
Ubuntucurl16.047.43.0-1ubuntu2vulnerable
Ubuntucurl16.047.45.0-1ubuntu1vulnerable
Ubuntucurl16.047.46.0-1ubuntu1vulnerable
Ubuntucurl16.047.47.0-1ubuntu1vulnerable
Ubuntucurl16.047.47.0-1ubuntu2vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.1vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.2vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.3vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.4vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.5fixed
Ubuntucurl16.047.43.0-1ubuntu2vulnerable
Ubuntucurl16.047.45.0-1ubuntu1vulnerable
Ubuntucurl16.047.46.0-1ubuntu1vulnerable
Ubuntucurl16.047.47.0-1ubuntu1vulnerable
Ubuntucurl16.047.47.0-1ubuntu2vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.1vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.2vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.3vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.4vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.5fixed
Susecurllinux enterprise desktop 12 sp27.37.0-37.11.3fixed
Susecurllinux enterprise desktop 12 sp37.37.0-37.11.3fixed
Susecurllinux enterprise server for raspberry pi 12 sp27.37.0-37.11.3fixed
Susecurllinux enterprise software development kit 12 sp27.37.0-37.11.3fixed
Susecurllinux enterprise software development kit 12 sp37.37.0-37.11.3fixed
Susecurllinux enterprise server 12 sp27.37.0-37.11.3fixed
Susecurllinux enterprise server for sap applications 12 sp27.37.0-37.11.3fixed
Susecurllinux enterprise server 12 sp37.37.0-37.11.3fixed
Susecurllinux enterprise server for sap applications 12 sp37.37.0-37.11.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancurlsourcesid7.57.0-1not yet assignedNot reportedNot reported
Debiancurlsourceforky7.57.0-1not yet assignedNot reportedNot reported
Debiancurlsourcetrixie7.57.0-1not yet assignedNot reportedNot reported
Debiancurlsourcebookworm7.57.0-1not yet assignedNot reportedNot reported
Alpinecurlapk3.107.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.117.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.127.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.137.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.147.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.157.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.167.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.177.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.187.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.197.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.207.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.217.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.227.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.237.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.247.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.47.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.57.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.67.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.77.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.87.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Alpinecurlapk3.97.57.0-r0Not reportedALPINE-CVE-2017-8816Not reported
Ubuntucurldeb14.047.35.0-1ubuntu2.13Not reportedUSN-3498-1Not reported
Ubuntucurldeb16.047.47.0-1ubuntu2.5Not reportedUSN-3498-1Not reported
Ubuntucurldeb16.047.47.0-1ubuntu2.5Not reportedUBUNTU-CVE-2017-8816Not reported
Susecurlrpmlinux enterprise desktop 12 sp27.37.0-37.11.3Not reportedSUSE-SU-2018:0122-1Not reported
Susecurlrpmlinux enterprise desktop 12 sp37.37.0-37.11.3Not reportedSUSE-SU-2018:0122-1Not reported
Susecurlrpmlinux enterprise server for raspberry pi 12 sp27.37.0-37.11.3Not reportedSUSE-SU-2018:0122-1Not reported
Susecurlrpmlinux enterprise software development kit 12 sp27.37.0-37.11.3Not reportedSUSE-SU-2018:0122-1Not reported
Susecurlrpmlinux enterprise software development kit 12 sp37.37.0-37.11.3Not reportedSUSE-SU-2018:0122-1Not reported
Susecurlrpmlinux enterprise server 12 sp27.37.0-37.11.3Not reportedSUSE-SU-2018:0122-1Not reported
Susecurlrpmlinux enterprise server for sap applications 12 sp27.37.0-37.11.3Not reportedSUSE-SU-2018:0122-1Not reported
Susecurlrpmlinux enterprise server 12 sp37.37.0-37.11.3Not reportedSUSE-SU-2018:0122-1Not reported
Susecurlrpmlinux enterprise server for sap applications 12 sp37.37.0-37.11.3Not reportedSUSE-SU-2018:0122-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [curl]Unknown
    Details (6)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

  • Source package: [curl]

    Details (6)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

  • [libcurl3-nss]Unknown

    Source package: [curl]

    Details (4)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

  • [libcurl4]Unknown

    Source package: [curl]

    Details (6)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

  • [libcurl4-doc]Unknown

    Source package: [curl]

    Details (6)
    • 7.88.1-10+deb12u15 · all · bookworm

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u15 · all · bookworm

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 8.14.1-2+deb13u2~bpo13+1 · all · bookworm-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 8.14.1-2+deb13u2~bpo13+1 · all · bookworm-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u5 · all · bookworm-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u5 · all · bookworm-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

  • Source package: [curl]

    Details (6)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

  • Source package: [curl]

    Details (4)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

  • Source package: [curl]

    Details (6)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · bookworm; dsa · curl · debian · 12

[Debian 13 (Trixie)]

  • [curl]Unknown
    Details (5)
    • 8.14.1-2+deb13u4 · amd64 · trixie

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.14.1-2+deb13u4 · arm64 · trixie

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.21.0-2~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.21.0-2~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.14.1-2+deb13u7 · amd64 · trixie-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

  • Source package: [curl]

    Details (5)
    • 8.14.1-2+deb13u4 · amd64 · trixie

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.14.1-2+deb13u4 · arm64 · trixie

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.21.0-2~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.21.0-2~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.14.1-2+deb13u7 · amd64 · trixie-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

  • [libcurl4-doc]Unknown

    Source package: [curl]

    Details (5)
    • 8.14.1-2+deb13u4 · all · trixie

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.14.1-2+deb13u4 · all · trixie

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.21.0-2~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.21.0-2~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.14.1-2+deb13u7 · all · trixie-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

  • Source package: [curl]

    Details (2)
    • 8.21.0-2~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.21.0-2~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

  • Source package: [curl]

    Details (5)
    • 8.14.1-2+deb13u4 · amd64 · trixie

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.14.1-2+deb13u4 · arm64 · trixie

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.21.0-2~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.21.0-2~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.14.1-2+deb13u7 · amd64 · trixie-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

  • Source package: [curl]

    Details (5)
    • 8.14.1-2+deb13u4 · amd64 · trixie

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.14.1-2+deb13u4 · arm64 · trixie

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.21.0-2~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.21.0-2~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.14.1-2+deb13u7 · amd64 · trixie-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

  • [libcurl4t64]Unknown

    Source package: [curl]

    Details (5)
    • 8.14.1-2+deb13u4 · amd64 · trixie

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.14.1-2+deb13u4 · arm64 · trixie

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.21.0-2~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.21.0-2~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

    • 8.14.1-2+deb13u7 · amd64 · trixie-security

      Fixed · Fixed: 7.57.0-1

      dsa · curl · debian · 13

Observed:

References