CVE-2013-2174
Last modified
CVE-2013-2174 is a vulnerability of currently unknown severity. Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.. EPSS estimates a 11.12% chance of exploitation in the next 30 days.
Description
Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Haxx | Curl | 7.7 |
| Haxx | Curl | 7.7.1 |
| Haxx | Curl | 7.7.2 |
| Haxx | Curl | 7.7.3 |
| Haxx | Curl | 7.8 |
| Haxx | Curl | 7.8.1 |
| Haxx | Curl | 7.9 |
| Haxx | Curl | 7.9.1 |
| Haxx | Curl | 7.9.2 |
| Haxx | Curl | 7.9.3 |
| Haxx | Curl | 7.9.4 |
| Haxx | Curl | 7.9.5 |
| Haxx | Curl | 7.9.6 |
| Haxx | Curl | 7.9.7 |
| Haxx | Curl | 7.9.8 |
| Haxx | Curl | 7.10 |
| Haxx | Curl | 7.10.1 |
| Haxx | Curl | 7.10.2 |
| Haxx | Curl | 7.10.3 |
| Haxx | Curl | 7.10.4 |
| Haxx | Curl | 7.10.5 |
| Haxx | Curl | 7.10.6 |
| Haxx | Curl | 7.10.7 |
| Haxx | Curl | 7.10.8 |
| Haxx | Curl | 7.11.0 |
| Haxx | Curl | 7.11.1 |
| Haxx | Curl | 7.11.2 |
| Haxx | Curl | 7.12.0 |
| Haxx | Curl | 7.12.1 |
| Haxx | Curl | 7.12.2 |
| Haxx | Curl | 7.12.3 |
| Haxx | Curl | 7.13.0 |
| Haxx | Curl | 7.13.1 |
| Haxx | Curl | 7.13.2 |
| Haxx | Curl | 7.14.0 |
| Haxx | Curl | 7.14.1 |
| Haxx | Curl | 7.15.0 |
| Haxx | Curl | 7.15.1 |
| Haxx | Curl | 7.15.2 |
| Haxx | Curl | 7.15.3 |
| Haxx | Curl | 7.15.4 |
| Haxx | Curl | 7.15.5 |
| Haxx | Curl | 7.16.0 |
| Haxx | Curl | 7.16.1 |
| Haxx | Curl | 7.16.2 |
| Haxx | Curl | 7.16.3 |
| Haxx | Curl | 7.16.4 |
| Haxx | Curl | 7.17.0 |
| Haxx | Curl | 7.17.1 |
| Haxx | Curl | 7.18.0 |
Showing 50 of 169 affected configurations. See NVD for the full list.
References
- http://curl.haxx.se/docs/adv_20130622.htmlVendor Advisory
- http://curl.haxx.se/docs/adv_20130622.htmlVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2013-2174?
How severe is CVE-2013-2174?
How do I fix CVE-2013-2174?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2013
- CVE-2013-2168The _dbus_printf_string_upper_bound function in dbus/dbus-sy…
- CVE-2013-2169Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2013-2170Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2013-2171The vm_map_lookup function in sys/vm/vm_map.c in the mmap im…
- CVE-2013-2172jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in …
- CVE-2013-2173wp-includes/class-phpass.php in WordPress 3.5.1, when a pass…
- CVE-2013-2175HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when con…
- CVE-2013-2176Unquoted Windows search path vulnerability in the Red Hat En…
- CVE-2013-2177Cross-site scripting (XSS) vulnerability in the Display Suit…
- CVE-2013-2178The apache-auth.conf, apache-nohome.conf, apache-noscript.co…
- CVE-2013-2179X.Org xdm 1.1.10, 1.1.11, and possibly other versions, when …
- CVE-2013-2180Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
Are you affected by CVE-2013-2174?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST