The vulnerability of the software for interacting with servers via CURL, related to errors in saving permissions, allows a hacker to expose protected information or cause service failures.

🗓️ 22 Dec 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

CURL server software has permission storage errors that expose data or cause service failures.

Reporter	Title	Published	Views	Family All 148
IBM Security Bulletins	Security Bulletin: Execution Engine for Apache Hadoop is vulnerable to heap-based buffer overflow and remote attacker to bypass security restrictions	20 Feb 202503:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in libcURL affect IBM Rational ClearCase ( CVE-2022-42915, CVE-2022-42916, CVE-2022-32221, CVE-2022-35252, CVE-2022-32205, CVE-2022-32206, CVE-2022-32207 )	31 Jan 202314:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MaaS360 Cloud Extender Agent and Base Module uses libcurl with multiple known vulnerabilities (CVE-2022-32205, CVE-2022-32206, CVE-2022-32207, CVE-2022-32208)	6 Oct 202204:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues	15 Apr 202502:31	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC	19 Jan 202320:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues	12 Apr 202414:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Wincollect agent is vulnerable to using components with know vulnerabilities	5 Dec 202219:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities fixed in 9.7.2.7	24 Oct 202411:46	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in libcurl affect IBM Spectrum Protect Plus SQL, File Indexing, and Windows Host agents	19 Sep 202222:54	–	ibm
FreeBSD	cURL -- Multiple vulnerabilities	27 Jun 202200:00	–	freebsd

Vulners

Node

novell suse_manager_retail_branch_serverMatch4.3

OR

novell suse_manager_proxyMatch4.3

OR

novell suse_manager_serverMatch4.3

OR

daniel_stenberg curlRange<7.84.0

OR

fedora fedoraMatch35

OR

novell opensuse_leapMatch15.4

Source	Link
seclists	www.seclists.org/fulldisclosure/2022/Oct/28
seclists	www.seclists.org/fulldisclosure/2022/Oct/41
hackerone	www.hackerone.com/reports/1573634
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/
security	www.security.gentoo.org/glsa/202212-01
security	www.security.netapp.com/advisory/ntap-20220915-0003/
support	www.support.apple.com/kb/HT213488
debian	www.debian.org/security/2022/dsa-5197
github	www.github.com/curl/curl/commit/b834890a3fa3f525cd8ef4e99554cdb4558d7e1b
github	www.github.com/curl/curl/commit/20f9dd6bae50b7223171b17ba7798946e74f877f

15 Feb 2023 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 39.8

CVSS 210

EPSS0.05481

server interaction permission storage data exposure service failure