---
title: "CVE-2016-8622\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2016-8622?format=md
keywords: index, follow
---

# CVE-2016-8622

Publication date 2 November 2016

Last updated 25 August 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**9.8 · Critical**

[Score breakdown](https://ubuntu.com/security/CVE-2016-8622?format=md#impact-score)

Toggle side navigation

## Description

The URL percent-encoding decode function in libcurl before 7.51.0 is called
`curl\_easy\_unescape`. Internally, even if this function would be made to
allocate a unscape destination buffer larger than 2GB, it would return that
new length in a signed 32 bit integer variable, thus the length would get
either just truncated or both truncated and turned negative. That could
then lead to libcurl writing outside of its heap based buffer.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| curl | 17.04 zesty | Fixed 7.50.1-1ubuntu2 |
| 16.10 yakkety | Fixed 7.50.1-1ubuntu1.1 |
| 16.04 LTS xenial | Fixed 7.47.0-1ubuntu2.2 |
| 14.04 LTS trusty | Fixed 7.35.0-1ubuntu2.10 |
| 12.04 LTS precise | Fixed 7.22.0-3ubuntu4.17 |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

9.8 · Critical

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | High |
  | Integrity impact | High |
  | Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 9.8 · Critical |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8622)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2016-8622)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2016-8622)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2016-8622)

### Related Ubuntu Security Notices (USN)

+ [USN-3123-1](https://usn.ubuntu.com/USN-3123-1)
+ curl vulnerabilities
+ 3 November 2016

### Other references

* <https://curl.haxx.se/docs/adv_20161102H.html>
* <https://www.cve.org/CVERecord?id=CVE-2016-8622>