{"id":"CVE-2024-6197","aliases":["ALPINE-CVE-2024-6197","AZL-47023","AZL-47028","AZL-47049","BELL-CVE-2024-6197","CURL-CVE-2024-6197","DEBIAN-CVE-2024-6197","EUVD-2024-47336","GHSA-x3h8-3mf2-v794","JLSEC-2025-36","SUSE-SU-2024:2784-1","SUSE-SU-2025:20029-1","UBUNTU-CVE-2024-6197","openSUSE-SU-2024:14225-1"],"status":"published","title":"freeing stack buffer in utf8asn1str","description":"libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer.  Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags.  The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.04296,"percentile":0.9121,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-07-24T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["8.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["8.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["8.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["8.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.9.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"curl","fixed_in":["8.8.0-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.30.3-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"curl","fixed_in":["8.8.0-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.9.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.9.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["8.9.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.9.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.9.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.9.0+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.3-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.0-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.6.0-r0"},{"fixed":"8.9.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.6.0-r0"},{"fixed":"8.9.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.6.0+0"},{"fixed":"8.9.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.6.0+0"},{"fixed":"8.9.0+0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-150600.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-150600.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-1.1"}]}],"bundled":2}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"libcurl"}],"references":[{"url":"https://curl.se/docs/CVE-2024-6197.json","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://curl.se/docs/CVE-2024-6197.html","tags":["x_transferred","Vendor Advisory","web","report"]},{"url":"https://hackerone.com/reports/2559516","tags":["x_transferred","Exploit","Issue Tracking","Technical Description","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/24/1","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/24/5","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20241129-0008/","tags":["advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6197","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241129-0008"},{"url":"https://github.com/advisories/GHSA-x3h8-3mf2-v794"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-6197","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-6197","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6197.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-6197","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242784-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227888","tags":["report"]},{"url":"https://bugzilla.suse.com/1228535","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7264","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520029-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221665","tags":["report"]},{"url":"https://bugzilla.suse.com/1221666","tags":["report"]},{"url":"https://bugzilla.suse.com/1221667","tags":["report"]},{"url":"https://bugzilla.suse.com/1221668","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2466","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-6197","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6197","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6874","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-6197","title":"freeing stack buffer in utf8asn1str","description":"libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer.  Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags.  The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.","status":"published","published":"2024-07-24T07:29:50.003Z","modified":"2025-02-13T17:54:41.039Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:34:11.305983Z"}],"euvd":[{"id":"EUVD-2024-47336","description":"libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer.  Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags.  The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.","status":"published","published":"2024-07-24T07:29:50Z","modified":"2025-02-13T17:54:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:31.305109Z"}],"ghsa":[{"id":"GHSA-x3h8-3mf2-v794","title":"libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string....","description":"libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer.  Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags.  The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.","status":"published","published":"2024-07-24T09:30:40Z","modified":"2024-11-29T12:31:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:58:59.859228Z"}],"nvd":[{"id":"CVE-2024-6197","description":"libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer.  Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags.  The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.","status":"published","published":"2024-07-24T08:15:03.34Z","modified":"2026-06-17T08:17:29.51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:10:14.437386Z"}],"osv":[{"id":"ALPINE-CVE-2024-6197","description":"libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer.  Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags.  The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.","status":"published","published":"2024-07-24T08:15:03.34Z","modified":"2026-11-02T11:17:50.132667552Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-47023","title":"CVE-2024-6197 affecting package curl for versions less than 8.8.0-2","description":"libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer.  Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags.  The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.","status":"published","published":"2024-07-24T08:15:03Z","modified":"2026-04-21T04:55:00.434465Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"AZL-47028","title":"CVE-2024-6197 affecting package cmake for versions less than 3.30.3-2","description":"libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer.  Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags.  The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.","status":"published","published":"2024-07-24T08:15:03Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"AZL-47049","title":"CVE-2024-6197 affecting package curl for versions less than 8.8.0-2","description":"libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer.  Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags.  The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.","status":"published","published":"2024-07-24T08:15:03Z","modified":"2026-04-21T04:32:48.406558Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"BELL-CVE-2024-6197","status":"published","published":"2024-07-25T05:58:43.155792Z","modified":"2026-01-26T09:37:09.406035Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2024-6197","title":"freeing stack buffer in utf8asn1str","description":"libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer.  Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags.  The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.","status":"published","published":"2024-07-24T07:29:50.003Z","modified":"2026-10-28T02:30:25.169067162Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:45.107804Z"},{"id":"DEBIAN-CVE-2024-6197","description":"libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer.  Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags.  The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.","status":"published","published":"2024-07-24T08:15:03.34Z","modified":"2026-11-02T12:03:11.802490198Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"JLSEC-2025-36","title":"libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string","description":"libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer.  Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags.  The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.","status":"published","published":"2025-10-10T15:04:01.319Z","modified":"2026-07-18T00:01:19.640376425Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"UBUNTU-CVE-2024-6197","description":"libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer.  Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.","status":"withdrawn","published":"2024-07-24T00:00:00Z","modified":"2025-07-16T07:47:59.401809Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"CURL-CVE-2024-6197","title":"freeing stack buffer in utf8asn1str","description":"libcurl's ASN1 parser has this `utf8asn1str()` function used for parsing an\nASN.1 UTF-8 string. It can detect an invalid field and return error.\nUnfortunately, when doing so it also invokes `free()` on a 4 byte local stack\nbuffer.\n\nMost modern malloc implementations detect this error and immediately abort.\nSome however accept the input pointer and add that memory to its list of\navailable chunks. This leads to the overwriting of nearby stack memory. The\ncontent of the overwrite is decided by the `free()` implementation; likely to\nbe memory pointers and a set of flags.\n\nThe most likely outcome of exploiting this flaw is a crash, although it cannot\nbe ruled out that more serious results can be had in special circumstances.","status":"published","published":"2024-07-24T08:00:00Z","modified":"2026-10-25T01:05:24.522932384Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2024:14225-1","title":"curl-8.9.0-1.1 on GA media","description":"These are all security issues fixed in the curl-8.9.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-30T00:00:00Z","modified":"2026-02-04T04:09:25.279877Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:2784-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2024-7264: Fixed ASN.1 date parser overread (bsc#1228535)\n- CVE-2024-6197: Fixed freeing stack buffer in utf8asn1str (bsc#1227888)\n","status":"published","published":"2024-08-06T12:58:40Z","modified":"2026-02-04T04:02:39.062499Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2025:20029-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2024-7264: ASN.1 date parser overread (bsc#1228535)\n- CVE-2024-6197: Freeing stack buffer in utf8asn1str (bsc#1227888)\n- CVE-2024-2379: QUIC certificate check bypass with wolfSSL (bsc#1221666)\n- CVE-2024-2466: TLS certificate check bypass with mbedTLS (bsc#1221668)\n- CVE-2024-2004: Usage of disabled protocol (bsc#1221665)\n- CVE-2024-2398: HTTP/2 push headers memory-leak (bsc#1221667)\n\nNon-security issue fixed:\n\n- Fixed various TLS related issues including FTP over SSL transmission timeouts.\n","status":"published","published":"2025-02-03T08:51:25Z","modified":"2026-03-23T04:50:02.900924Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}