CVE-2005-0490

Published: May 2, 2005Modified: Apr 16, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.

Affected (2)

Products: Haxx: Curl, Libcurl

2 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Haxx Curl	Version 7.12.1
Haxx Libcurl	Version 7.12.1

Related CWEs

Incorrect Calculation of Buffer Size

The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

References (24)

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000940

Source: cve@mitre.org

Broken LinkPatchVendor Advisory

http://marc.info/?l=full-disclosure&m=110959085507755&w=2

Source: cve@mitre.org

Mailing ListPatch

http://www.gentoo.org/security/en/glsa/glsa-200503-20.xml

Source: cve@mitre.org

Third Party Advisory

http://www.idefense.com/application/poi/display?id=202&type=vulnerabilities

Source: cve@mitre.org

Broken LinkVendor Advisory

http://www.idefense.com/application/poi/display?id=203&type=vulnerabilities

Source: cve@mitre.org

Broken LinkVendor Advisory

http://www.mandriva.com/security/advisories?name=MDKSA-2005:048

Source: cve@mitre.org

Third Party Advisory

http://www.novell.com/linux/security/advisories/2005_11_curl.html

Source: cve@mitre.org

Broken Link

http://www.redhat.com/support/errata/RHSA-2005-340.html

Source: cve@mitre.org

Broken Link

http://www.securityfocus.com/bid/12615

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/12616

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/19423

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10273

Source: cve@mitre.org

Broken Link

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000940

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkPatchVendor Advisory

http://marc.info/?l=full-disclosure&m=110959085507755&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatch

http://www.gentoo.org/security/en/glsa/glsa-200503-20.xml

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.idefense.com/application/poi/display?id=202&type=vulnerabilities

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkVendor Advisory

http://www.idefense.com/application/poi/display?id=203&type=vulnerabilities

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkVendor Advisory

http://www.mandriva.com/security/advisories?name=MDKSA-2005:048

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.novell.com/linux/security/advisories/2005_11_curl.html

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.redhat.com/support/errata/RHSA-2005-340.html

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.securityfocus.com/bid/12615

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/12616

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/19423

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10273

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.