Candidate: CVE-2017-9502
PublicDate: 2017-06-14 13:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9502
 http://openwall.com/lists/oss-security/2017/06/14/1
 https://curl.haxx.se/docs/adv_20170614.html
Description:
 In curl before 7.54.1 on Windows and DOS, libcurl's default protocol
 function, which is the logic that allows an application to set which
 protocol libcurl should attempt to use when given a URL without a scheme
 part, had a flaw that could lead to it overwriting a heap based memory
 buffer with seven bytes. If the default protocol is specified to be FILE or
 a file: URL lacks two slashes, the given "URL" starts with a drive letter,
 and libcurl is built for Windows or DOS, then libcurl would copy the path 7
 bytes off, so that the end of the given path would write beyond the malloc
 buffer (7 bytes being the length in bytes of the ascii string "file://").
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L [5.3 MEDIUM]

Patches_curl:
upstream_curl: not-affected (Windows/Dos only)
precise/esm_curl: not-affected (Windows/Dos only)
trusty_curl: not-affected (Windows/Dos only)
trusty/esm_curl: not-affected (Windows/Dos only)
vivid/stable-phone-overlay_curl: not-affected (Windows/Dos only)
vivid/ubuntu-core_curl: not-affected (Windows/Dos only)
xenial_curl: not-affected (Windows/Dos only)
esm-infra/xenial_curl: not-affected (Windows/Dos only)
yakkety_curl: not-affected (Windows/Dos only)
zesty_curl: not-affected (Windows/Dos only)
devel_curl: not-affected (Windows/Dos only)