nvd-json-data-feeds/CVE-2017/CVE-2017-74xx/CVE-2017-7407.json

{
  "id": "CVE-2017-7407",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2017-04-03T20:59:00.247",
  "lastModified": "2019-10-03T00:03:26.223",
  "vulnStatus": "Modified",
  "descriptions": [
    {
      "lang": "en",
      "value": "The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n ourWriteOut en tool_writeout.c en curl 7.53.1 podr\u00eda permitir que los atacantes f\u00edsicamente pr\u00f3ximos obtengan informaci\u00f3n sensible de la memoria del proceso en circunstancias oportunistas leyendo una pantalla de la estaci\u00f3n de trabajo durante el uso de un argumento --write-out que termina en un car\u00e1cter '%', lo que conduce a desbordamiento de b\u00fafer basado en memoria din\u00e1mica."
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "attackVector": "PHYSICAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.4,
          "baseSeverity": "LOW"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 1.4
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "accessVector": "LOCAL",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.1
        },
        "baseSeverity": "LOW",
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "acInsufInfo": true,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:haxx:curl:7.53.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "641ACFC8-BDE2-42AC-8B3D-EF78695AD750"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:3558",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/curl/curl/commit/1890d59905414ab84a35892b2e45833654aa5c13",
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://security.gentoo.org/glsa/201709-14",
      "source": "cve@mitre.org"
    }
  ]
}