Curl CVE-2018-16840 Use After Free Arbitrary Code Execution Vulnerability

Bugtraq ID:	107192
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2018-16840
Remote:	Yes
Local:	No
Published:	Oct 31 2018 12:00AM
Updated:	Oct 31 2018 12:00AM
Credit:	Brian Carpenter (Geeknik Labs)
Vulnerable:	Ubuntu Ubuntu Linux 18.10 Ubuntu Ubuntu Linux 18.04 LTS Ubuntu Ubuntu Linux 16.04 LTS Ubuntu Ubuntu Linux 14.04 LTS Redhat Software Collections for RHEL 0 Haxx Curl 7.61.1 Haxx Curl 7.61 Haxx Curl 7.60 Haxx Curl 7.59
Not Vulnerable:

Curl CVE-2018-16840 Use After Free Arbitrary Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Curl CVE-2018-16840 Use After Free Arbitrary Code Execution Vulnerability

References:

• cURL Home Page (cURL)
  
• Curl_close: clear data->multi_easy on free to avoid use-after-free (Curl)
  
• Bug 1642203 CVE-2018-16840 curl: Use-after-free when closing "easy" handle (Redhat)
  
• use-after-free in handle close (Curl)
  
• USN-3805-1: curl vulnerabilities (Ubuntu)