CVE-2024-7264 — ASN.1 date parser overread

Description

libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an
ASN.1 Generalized Time field. If given an syntactically incorrect field, the
parser might end up using -1 for the length of the *time fraction*, leading to
a `strlen()` getting performed on a pointer to a heap buffer area that is not
(purposely) null terminated.

This flaw most likely leads to a crash, but can also lead to heap contents
getting returned to the application when
[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.

Affected products

Vendor	Product	Affected	Fixed
curl	curl	8.9.0 – ≤ 8.9.0, 8.8.0 – ≤ 8.8.0, 8.7.1 – ≤ 8.7.1, 8.7.0 – ≤ 8.7.0, 8.6.0 – ≤ 8.6.0, 8.5.0 – ≤ 8.5.0, 8.4.0 – ≤ 8.4.0, 8.3.0 – ≤ 8.3.0, 8.2.1 – ≤ 8.2.1, 8.2.0 – ≤ 8.2.0, 8.1.2 – ≤ 8.1.2, 8.1.1 – ≤ 8.1.1, 8.1.0 – ≤ 8.1.0, 8.0.1 – ≤ 8.0.1, 8.0.0 – ≤ 8.0.0, 7.88.1 – ≤ 7.88.1, 7.88.0 – ≤ 7.88.0, 7.87.0…	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	curl	8.9.1-1	—
Debian 13	curl	8.9.1-1	—
Debian 12	curl	7.88.1-10+deb12u7	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 24.04 LTS	curl	8.5.0-2ubuntu10.2	USN-6944-1
Ubuntu 22.04 LTS	curl	7.81.0-1ubuntu1.17	USN-6944-1
Ubuntu 20.04 LTS	curl	7.68.0-1ubuntu2.23	USN-6944-1

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 18.04 LTS	curl	7.58.0-2ubuntu3.24+esm5	USN-6944-2
Ubuntu Pro 16.04 LTS	curl	7.47.0-1ubuntu2.19+esm13	USN-6944-2
Ubuntu Pro 14.04 LTS	curl	7.35.0-1ubuntu2.20+esm18	USN-6944-2

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	mysql +6	8.0.41-2.el9_5	RHSA-2025:1671
RHEL 8	mecab +1	0.996-2.module+el8.10.0+22857+7f331edd	RHSA-2025:1673
RHEL 8	mecab-ipadic +1	2.7.0.20070801-17.module+el8.10.0+22857+7f331edd	RHSA-2025:1673
RHEL 8	mysql +6	8.0.41-1.module+el8.10.0+22857+7f331edd	RHSA-2025:1673

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	mysql +6	8.0.41-2.el9_5	ALSA-2025:1671
AlmaLinux 8	mecab +1	0.996-2.module_el8.6.0+3340+d764b636	ALSA-2025:1673
AlmaLinux 8	mecab-ipadic +1	2.7.0.20070801-17.module_el8.10.0+3965+b415b607	ALSA-2025:1673
AlmaLinux 8	mysql +6	8.0.41-1.module_el8.10.0+3965+b415b607	ALSA-2025:1673

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 9	mysql	8.0.41-2.el9_5	RLSA-2025:1671
Rocky Linux 8	mecab	0.996-2.module+el8.10.0+1676+9b4b6e24	RLSA-2025:1673
Rocky Linux 8	mecab-ipadic	2.7.0.20070801-17.module+el8.10.0+1937+28fbbc83	RLSA-2025:1673
Rocky Linux 8	mysql	8.0.41-1.module+el8.10.0+1937+28fbbc83.0.1	RLSA-2025:1673

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP6	curl	8.6.0-150600.4.3.1	SUSE-SU-2024:2784-1
SLES 15 SP5	curl	8.0.1-150400.5.47.1	SUSE-SU-2024:3080-1
SLES 15 SP4	curl	8.0.1-150400.5.47.1	SUSE-SU-2024:3080-2
SLES 12 SP5	curl	8.0.1-11.89.1	SUSE-SU-2024:2938-1

Show 13 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15 SP4	curl	8.0.1-150400.5.47.1	SUSE-SU-2024:3080-2
SLES for SAP 12 SP5	curl	8.0.1-11.89.1	SUSE-SU-2024:2938-1
SLE Micro 6.0	curl	8.6.0-3.1	SUSE-SU-2025:20029-1
SLE Micro 5.5	curl	8.0.1-150400.5.47.1	SUSE-SU-2024:3080-1
SLE Micro 5.4	curl	8.0.1-150400.5.47.1	SUSE-SU-2024:3080-1
SLE Micro 5.3	curl	8.0.1-150400.5.47.1	SUSE-SU-2024:3080-1
SLE Micro 5.2	curl	7.66.0-150200.4.75.1	SUSE-SU-2024:3202-1, SUSE-SU-2024:2930-1
SLE Micro 5.1	curl	7.66.0-150200.4.75.1	SUSE-SU-2024:3202-1, SUSE-SU-2024:2930-1
SLE HPC 15 SP4	curl	8.0.1-150400.5.47.1	SUSE-SU-2024:3080-2
SUSE Manager Server 4.3	curl	8.0.1-150400.5.47.1	SUSE-SU-2024:3080-2
SUSE Manager Proxy 4.3	curl	8.0.1-150400.5.47.1	SUSE-SU-2024:3080-2
SUSE Linux Enterprise Installer Updates 15 SP5	curl	8.0.1-150400.5.47.1	SUSE-SU-2024:3080-1
SUSE Linux Enterprise Installer Updates 15 SP4	curl	8.0.1-150400.5.47.1	SUSE-SU-2024:3080-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	curl	8.9.1-1.1	openSUSE-SU-2024:14261-1
openSUSE Leap 15.6	curl	8.6.0-150600.4.3.1	SUSE-SU-2024:2784-1
openSUSE Leap 15.5	curl	8.0.1-150400.5.47.1	SUSE-SU-2024:3080-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
openSUSE Leap Micro 5.5	curl	8.0.1-150400.5.47.1	SUSE-SU-2024:3080-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	curl	8.9.1-r0	—
Alpine v3.23	curl	8.9.1-r0	—
Alpine v3.22	curl	8.9.1-r0	—
Alpine v3.21	curl	8.9.1-r0	—
Alpine v3.20	curl	8.9.1-r0	—

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	curl	8.9.1-r0	—
Alpine v3.18	curl	8.9.1-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	ecs-service-connect-agent	v1.29.9.0-1.amzn2023	ALAS2023-2026-1603

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	cmake	3.30.3-4	—
Azure Linux 2 (CBL-Mariner)	rust	1.68.0-1	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	mysql +6	8.0.41-2.el9_5	ELSA-2025-1671
Oracle Linux 8	mecab +1	0.996-2.module+el8.10.0+90521+d5cc5c65	ELSA-2025-1673
Oracle Linux 8	mecab-ipadic +1	2.7.0.20070801-17.0.1.module+el8.10.0+90521+d5cc5c65	ELSA-2025-1673
Oracle Linux 8	mysql +6	8.0.41-1.module+el8.10.0+90521+d5cc5c65	ELSA-2025-1673

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	curl	8.9.1-r0	—

Advisories 40

WID-SEC-2024-1736 cURL und libcurl: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 10, 2026
ALSA-2025:1671 Important: mysql security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:1673 Important: mysql:8.0 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2025:1673 Red Hat Security Advisory: mysql:8.0 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2025:1671 Red Hat Security Advisory: mysql security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
WID-SEC-2024-3188 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 13, 2026
SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
USN-6944-2 curl vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
ALAS2023-2026-1603 Moderate: ecs-service-connect-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 1, 2026
USN-6944-1 curl vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
SUSE-SU-2025:20029-1 Security update for curl SUSE / openSUSE Security Updates · Mar 23, 2026
ICSA-26-043-06 Siemens SINEC OS CISA ICS & IT advisories · Feb 25, 2026
ICSA-25-226-07 Siemens Third-Party Components in SINEC OS CISA ICS & IT advisories · Feb 25, 2026
SSA-089022 SSA-089022: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.3 Siemens ProductCERT · Feb 24, 2026
SSA-355557 SSA-355557: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.2 Siemens ProductCERT · Feb 24, 2026
WID-SEC-2025-2836 Apple iOS und iPadOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 11, 2026
RLSA-2025:1673 Important: mysql:8.0 security update Rocky Linux Security Advisories · Feb 5, 2026
openSUSE-SU-2024:14261-1 curl-8.9.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:2930-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:2784-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:3202-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:3080-2 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:2938-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:3080-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
WID-SEC-2025-2838 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 17, 2025
NCSC-2025-0397 Kwetsbaarheden verholpen in Apple iOS en iPadOS NCSC-NL (Netherlands) · Dec 15, 2025
NCSC-2025-0396 Kwetsbaarheden verholpen in Apple macOS NCSC-NL (Netherlands) · Dec 15, 2025
RLSA-2025:1671 Important: mysql security update Rocky Linux Security Advisories · Oct 9, 2025
WID-SEC-2025-0225 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2025
ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
WID-SEC-2025-1560 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
NCSC-2025-0129 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Apr 16, 2025
ELSA-2025-1671 Important: mysql security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Feb 21, 2025
ELSA-2025-1673 Important: mysql:8.0 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 20, 2025
WID-SEC-2024-3201 Oracle Database Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 6, 2024
NCSC-2024-0420 Kwetsbaarheden verholpen in Oracle MySQL NCSC-NL (Netherlands) · Oct 17, 2024
NCSC-2024-0414 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 17, 2024
NCSC-2024-0411 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 17, 2024
WID-SEC-2024-3196 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024

EUVD	v3.1	6.3
CISA-ADP	v3.1	6.3

ASN.1 date parser overread

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Azure Linux

Oracle Linux

Wolfi

Advisories 40

References