Skip to content
OpenAdvisories
Medium USN-6944-2 1 CVE

curl vulnerability

Published Aug 20, 2024 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

USN-6944-1 fixed CVE-2024-7264 for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and
Ubuntu 24.04 LTS. This update provides the corresponding fix for
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.

Original advisory details:

Dov Murik discovered that curl incorrectly handled parsing ASN.1
Generalized Time fields. A remote attacker could use this issue to cause
curl to crash, resulting in a denial of service, or possibly obtain
sensitive memory contents.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS curl 7.35.0-1ubuntu2.20+esm18
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS curl 7.47.0-1ubuntu2.19+esm13
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS curl 7.58.0-2ubuntu3.24+esm5

Vulnerabilities 1

  • Medium 6.3
    CVE-2024-7264 EPSS 20%

    ASN.1 date parser overread

    libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting per…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2024-7264