What’s Vulnerable › Vulnerabilities

CVE-2013-2174

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 9.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2013-07-31 · updated 2026-06-16
• Weakness: CWE-119

Description

Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.

Affected products

• Canonical Ubuntu Linux: 10.04, 12.04, 12.10, 13.04
• curl: 7.7, 7.7.1, 7.7.2, 7.7.3, 7.8, 7.8.1 (+75)
• curl: 7.7, 7.7.1, 7.7.2, 7.7.3, 7.8, 7.8.1 (+75)
• Opensuse: 11.4
• Red Hat Enterprise Linux: 5, 6.0

References

• http://curl.haxx.se/docs/adv_20130622.html
• http://lists.opensuse.org/opensuse-updates/2013-07/msg00013.html
• http://rhn.redhat.com/errata/RHSA-2013-0983.html
• http://www.debian.org/security/2013/dsa-2713
• http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
• http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
• http://www.securityfocus.com/bid/60737
• http://www.ubuntu.com/usn/USN-1894-1
• https://github.com/bagder/curl/commit/192c4f788d48f82c03e9cef40013f34370e90737
• http://curl.haxx.se/docs/adv_20130622.html
• http://lists.opensuse.org/opensuse-updates/2013-07/msg00013.html
• http://rhn.redhat.com/errata/RHSA-2013-0983.html

Get alerted when CVE-2013-2174 or the next vulnerability affects your stack