{"title": "CVE-2015-3143", "reporter": "NVD", "published": "2015-04-24T10:59:08", "cpe": ["cpe:/o:apple:mac_os_x:10.10.4", "cpe:/a:haxx:libcurl:7.31.0", "cpe:/a:haxx:curl:7.29.0", "cpe:/a:haxx:libcurl:7.16.0", "cpe:/a:haxx:curl:7.21.1", "cpe:/a:haxx:libcurl:7.41.0", "cpe:/a:haxx:libcurl:7.13.1", "cpe:/a:haxx:curl:7.13.0", "cpe:/a:hp:system_management_homepage:7.5.3.1", "cpe:/a:haxx:curl:7.16.3", "cpe:/a:haxx:curl:7.30.0", "cpe:/a:haxx:curl:7.26.0", "cpe:/o:apple:mac_os_x:10.10.2", "cpe:/a:haxx:libcurl:7.29.0", "cpe:/a:haxx:libcurl:7.16.1", "cpe:/a:haxx:curl:7.19.3", "cpe:/a:haxx:curl:7.18.1", "cpe:/a:haxx:curl:7.15.2", "cpe:/a:haxx:curl:7.19.2", "cpe:/a:haxx:curl:7.24.0", "cpe:/a:haxx:libcurl:7.11.1", "cpe:/a:haxx:libcurl:7.40.0", "cpe:/a:haxx:curl:7.16.4", "cpe:/a:haxx:libcurl:7.18.1", "cpe:/o:canonical:ubuntu_linux:15.04", "cpe:/o:apple:mac_os_x:10.9.5", "cpe:/a:haxx:curl:7.21.5", "cpe:/a:haxx:libcurl:7.19.1", "cpe:/a:haxx:libcurl:7.19.2", "cpe:/a:haxx:libcurl:7.22.0", "cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~", "cpe:/a:haxx:curl:7.13.1", "cpe:/a:haxx:curl:7.35.0", "cpe:/a:haxx:curl:7.10.6", "cpe:/a:haxx:curl:7.21.2", "cpe:/a:haxx:libcurl:7.35.0", "cpe:/a:haxx:libcurl:7.26.0", "cpe:/a:haxx:curl:7.41.0", "cpe:/a:haxx:curl:7.21.4", "cpe:/a:haxx:libcurl:7.25.0", "cpe:/a:haxx:libcurl:7.21.4", "cpe:/a:haxx:curl:7.21.0", "cpe:/a:haxx:libcurl:7.13.2", "cpe:/a:haxx:libcurl:7.34.0", "cpe:/a:haxx:curl:7.15.0", "cpe:/a:haxx:libcurl:7.19.7", "cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~", "cpe:/a:haxx:curl:7.21.7", "cpe:/a:haxx:curl:7.20.0", "cpe:/a:haxx:curl:7.25.0", "cpe:/a:haxx:libcurl:7.12.1", "cpe:/a:haxx:curl:7.19.0", "cpe:/a:haxx:curl:7.12.2", "cpe:/a:haxx:curl:7.16.0", "cpe:/a:haxx:curl:7.40.0", "cpe:/a:haxx:curl:7.10.7", "cpe:/a:haxx:libcurl:7.15.5", "cpe:/a:haxx:libcurl:7.33.0", "cpe:/a:haxx:curl:7.34.0", "cpe:/a:haxx:curl:7.18.2", "cpe:/a:haxx:curl:7.18.0", "cpe:/a:haxx:curl:7.19.7", "cpe:/a:haxx:libcurl:7.20.0", "cpe:/a:haxx:libcurl:7.32.0", "cpe:/a:haxx:libcurl:7.12.2", "cpe:/a:haxx:curl:7.16.1", "cpe:/a:haxx:libcurl:7.16.2", "cpe:/a:haxx:curl:7.27.0", "cpe:/a:haxx:libcurl:7.15.4", "cpe:/a:haxx:curl:7.21.6", "cpe:/a:haxx:libcurl:7.19.6", "cpe:/a:haxx:curl:7.23.1", "cpe:/a:haxx:libcurl:7.28.0", "cpe:/a:haxx:libcurl:7.15.2", "cpe:/a:haxx:libcurl:7.19.0", "cpe:/a:haxx:libcurl:7.19.4", "cpe:/a:haxx:curl:7.36.0", "cpe:/a:haxx:libcurl:7.15.0", "cpe:/a:haxx:libcurl:7.21.0", "cpe:/a:haxx:curl:7.31.0", "cpe:/a:haxx:curl:7.15.4", "cpe:/a:haxx:curl:7.11.0", "cpe:/a:haxx:libcurl:7.11.0", "cpe:/a:haxx:libcurl:7.12.0", "cpe:/a:haxx:libcurl:7.24.0", "cpe:/a:haxx:libcurl:7.36.0", "cpe:/a:haxx:libcurl:7.37.1", "cpe:/o:canonical:ubuntu_linux:14.10", "cpe:/a:haxx:libcurl:7.16.3", "cpe:/a:haxx:curl:7.19.6", "cpe:/a:haxx:libcurl:7.14.1", "cpe:/a:haxx:libcurl:7.21.6", "cpe:/a:haxx:libcurl:7.12.3", "cpe:/a:haxx:libcurl:7.23.0", "cpe:/a:haxx:curl:7.15.1", "cpe:/a:haxx:libcurl:7.38.0", "cpe:/a:haxx:libcurl:7.17.0", "cpe:/a:haxx:curl:7.39.0", "cpe:/a:haxx:curl:7.17.1", "cpe:/a:haxx:curl:7.15.3", "cpe:/a:haxx:libcurl:7.27.0", "cpe:/a:haxx:curl:7.32.0", "cpe:/a:haxx:libcurl:7.28.1", "cpe:/a:haxx:libcurl:7.11.2", "cpe:/a:haxx:curl:7.37.1", "cpe:/a:haxx:libcurl:7.16.4", "cpe:/a:haxx:curl:7.23.0", "cpe:/a:haxx:curl:7.15.5", "cpe:/a:haxx:curl:7.14.1", "cpe:/a:haxx:curl:7.14.0", "cpe:/a:haxx:libcurl:7.17.1", "cpe:/a:haxx:curl:7.11.2", "cpe:/a:haxx:curl:7.11.1", "cpe:/a:haxx:curl:7.38.0", "cpe:/a:haxx:libcurl:7.21.2", "cpe:/a:haxx:curl:7.12.1", "cpe:/o:debian:debian_linux:7.0", "cpe:/a:haxx:libcurl:7.14.0", "cpe:/a:haxx:curl:7.20.1", "cpe:/a:haxx:curl:7.33.0", "cpe:/a:haxx:libcurl:7.21.3", "cpe:/a:haxx:curl:7.19.4", "cpe:/a:haxx:curl:7.21.3", "cpe:/o:apple:mac_os_x:10.10.0", "cpe:/a:haxx:curl:7.13.2", "cpe:/a:haxx:libcurl:7.23.1", "cpe:/a:haxx:curl:7.12.3", "cpe:/a:haxx:libcurl:7.20.1", "cpe:/a:haxx:libcurl:7.15.1", "cpe:/a:haxx:curl:7.17.0", "cpe:/o:apple:mac_os_x:10.10.3", "cpe:/a:haxx:curl:7.19.1", "cpe:/a:haxx:libcurl:7.13.0", "cpe:/a:haxx:libcurl:7.21.1", "cpe:/a:haxx:libcurl:7.39", "cpe:/a:haxx:curl:7.28.1", "cpe:/a:haxx:libcurl:7.30.0", "cpe:/a:haxx:libcurl:7.21.7", "cpe:/a:haxx:curl:7.10.8", "cpe:/a:haxx:curl:7.19.5", "cpe:/a:haxx:libcurl:7.19.3", "cpe:/a:haxx:curl:7.22.0", "cpe:/a:haxx:libcurl:7.21.5", "cpe:/a:haxx:libcurl:7.10.7", "cpe:/o:apple:mac_os_x:10.10.1", "cpe:/a:haxx:libcurl:7.15.3", "cpe:/a:haxx:libcurl:7.10.6", "cpe:/a:haxx:libcurl:7.18.0", "cpe:/a:haxx:curl:7.28.0", "cpe:/a:haxx:libcurl:7.19.5", "cpe:/a:haxx:libcurl:7.10.8", "cpe:/a:haxx:libcurl:7.37.0", "cpe:/a:haxx:curl:7.16.2", "cpe:/a:haxx:curl:7.12.0", "cpe:/a:haxx:libcurl:7.18.2"], "cvelist": ["CVE-2015-3143"], "viewCount": 38, "objectVersion": "1.3", "type": "cve", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3143", "bulletinFamily": "NVD", "hashmap": [{"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "dd8a2327867ba6e32f721166a6895c8c", "key": "cpe"}, {"hash": "f52955f97794ee9c7a95312cf001f4ba", "key": "cvelist"}, {"hash": "26769fd423968d45be7383413e2552f1", "key": "cvss"}, {"hash": "c9c238bb8ce153bfe8809696063334bb", "key": "description"}, {"hash": "f5d1bfdf7636c93dbcc7070fe1a7d940", "key": "href"}, {"hash": "aa119e6f877a60dfb25436cf92ab2c72", "key": "modified"}, {"hash": "8085a92d19ca383d0d074107d7f33bd4", "key": "published"}, {"hash": "1abc6d4a5b978f42356702359055fde9", "key": "references"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "dcf1671a73bc352ba4135fef42c537e3", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}], "history": [{"bulletin": {"reporter": "NVD", "published": "2015-04-24T10:59:08", "cvelist": ["CVE-2015-3143"], "title": "CVE-2015-3143", "objectVersion": "1.2", "type": "cve", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3143", "bulletinFamily": "NVD", "id": "CVE-2015-3143", "history": [], "scanner": [], "cpe": ["cpe:/o:apple:mac_os_x:10.10.4", "cpe:/a:haxx:libcurl:7.31.0", "cpe:/a:haxx:curl:7.29.0", "cpe:/a:haxx:libcurl:7.16.0", "cpe:/a:haxx:curl:7.21.1", "cpe:/a:haxx:libcurl:7.41.0", "cpe:/a:haxx:libcurl:7.13.1", "cpe:/a:haxx:curl:7.13.0", "cpe:/a:hp:system_management_homepage:7.5.3.1", "cpe:/a:haxx:curl:7.16.3", "cpe:/a:haxx:curl:7.30.0", "cpe:/a:haxx:curl:7.26.0", "cpe:/o:apple:mac_os_x:10.10.2", "cpe:/a:haxx:libcurl:7.29.0", "cpe:/a:haxx:libcurl:7.16.1", "cpe:/a:haxx:curl:7.19.3", "cpe:/a:haxx:curl:7.18.1", "cpe:/a:haxx:curl:7.15.2", "cpe:/a:haxx:curl:7.19.2", "cpe:/a:haxx:curl:7.24.0", "cpe:/a:haxx:libcurl:7.11.1", "cpe:/a:haxx:libcurl:7.40.0", "cpe:/a:haxx:curl:7.16.4", "cpe:/a:haxx:libcurl:7.18.1", "cpe:/o:canonical:ubuntu_linux:15.04", "cpe:/o:apple:mac_os_x:10.9.5", "cpe:/a:haxx:curl:7.21.5", "cpe:/a:haxx:libcurl:7.19.1", "cpe:/a:haxx:libcurl:7.19.2", "cpe:/a:haxx:libcurl:7.22.0", "cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~", "cpe:/a:haxx:curl:7.13.1", "cpe:/a:haxx:curl:7.35.0", "cpe:/a:haxx:curl:7.10.6", "cpe:/a:haxx:curl:7.21.2", "cpe:/a:haxx:libcurl:7.35.0", "cpe:/a:haxx:libcurl:7.26.0", "cpe:/a:haxx:curl:7.41.0", "cpe:/a:haxx:curl:7.21.4", "cpe:/a:haxx:libcurl:7.25.0", "cpe:/a:haxx:libcurl:7.21.4", "cpe:/a:haxx:curl:7.21.0", "cpe:/a:haxx:libcurl:7.13.2", "cpe:/a:haxx:libcurl:7.34.0", "cpe:/a:haxx:curl:7.15.0", "cpe:/a:haxx:libcurl:7.19.7", "cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~", "cpe:/a:haxx:curl:7.21.7", "cpe:/a:haxx:curl:7.20.0", "cpe:/a:haxx:curl:7.25.0", "cpe:/a:haxx:libcurl:7.12.1", "cpe:/a:haxx:curl:7.19.0", "cpe:/a:haxx:curl:7.12.2", "cpe:/a:haxx:curl:7.16.0", "cpe:/a:haxx:curl:7.40.0", "cpe:/a:haxx:curl:7.10.7", "cpe:/a:haxx:libcurl:7.15.5", "cpe:/a:haxx:libcurl:7.33.0", "cpe:/a:haxx:curl:7.34.0", "cpe:/a:haxx:curl:7.18.2", "cpe:/a:haxx:curl:7.18.0", "cpe:/a:haxx:curl:7.19.7", "cpe:/a:haxx:libcurl:7.20.0", "cpe:/a:haxx:libcurl:7.32.0", "cpe:/a:haxx:libcurl:7.12.2", "cpe:/a:haxx:curl:7.16.1", "cpe:/a:haxx:libcurl:7.16.2", "cpe:/a:haxx:curl:7.27.0", "cpe:/a:haxx:libcurl:7.15.4", "cpe:/a:haxx:curl:7.21.6", "cpe:/a:haxx:libcurl:7.19.6", "cpe:/a:haxx:curl:7.23.1", "cpe:/a:haxx:libcurl:7.28.0", "cpe:/a:haxx:libcurl:7.15.2", "cpe:/a:haxx:libcurl:7.19.0", "cpe:/a:haxx:libcurl:7.19.4", "cpe:/a:haxx:curl:7.36.0", "cpe:/a:haxx:libcurl:7.15.0", "cpe:/a:haxx:libcurl:7.21.0", "cpe:/a:haxx:curl:7.31.0", "cpe:/a:haxx:curl:7.15.4", "cpe:/a:haxx:curl:7.11.0", "cpe:/a:haxx:libcurl:7.11.0", "cpe:/a:haxx:libcurl:7.12.0", "cpe:/a:haxx:libcurl:7.24.0", "cpe:/a:haxx:libcurl:7.36.0", "cpe:/a:haxx:libcurl:7.37.1", "cpe:/o:canonical:ubuntu_linux:14.10", "cpe:/a:haxx:libcurl:7.16.3", "cpe:/a:haxx:curl:7.19.6", "cpe:/a:haxx:libcurl:7.14.1", "cpe:/a:haxx:libcurl:7.21.6", "cpe:/a:haxx:libcurl:7.12.3", "cpe:/a:haxx:libcurl:7.23.0", "cpe:/a:haxx:curl:7.15.1", "cpe:/a:haxx:libcurl:7.38.0", "cpe:/a:haxx:libcurl:7.17.0", "cpe:/a:haxx:curl:7.39.0", "cpe:/a:haxx:curl:7.17.1", "cpe:/a:haxx:curl:7.15.3", "cpe:/a:haxx:libcurl:7.27.0", "cpe:/a:haxx:curl:7.32.0", "cpe:/a:haxx:libcurl:7.28.1", "cpe:/a:haxx:libcurl:7.11.2", "cpe:/a:haxx:curl:7.37.1", "cpe:/a:haxx:libcurl:7.16.4", "cpe:/a:haxx:curl:7.23.0", "cpe:/a:haxx:curl:7.15.5", "cpe:/a:haxx:curl:7.14.1", "cpe:/a:haxx:curl:7.14.0", "cpe:/a:haxx:libcurl:7.17.1", "cpe:/a:haxx:curl:7.11.2", "cpe:/a:haxx:curl:7.11.1", "cpe:/a:haxx:curl:7.38.0", "cpe:/a:haxx:libcurl:7.21.2", "cpe:/a:haxx:curl:7.12.1", "cpe:/o:debian:debian_linux:7.0", "cpe:/a:haxx:libcurl:7.14.0", "cpe:/a:haxx:curl:7.20.1", "cpe:/a:haxx:curl:7.33.0", "cpe:/a:haxx:libcurl:7.21.3", "cpe:/a:haxx:curl:7.19.4", "cpe:/a:haxx:curl:7.21.3", "cpe:/o:apple:mac_os_x:10.10.0", "cpe:/a:haxx:curl:7.13.2", "cpe:/a:haxx:libcurl:7.23.1", "cpe:/a:haxx:curl:7.12.3", "cpe:/a:haxx:libcurl:7.20.1", "cpe:/a:haxx:libcurl:7.15.1", "cpe:/a:haxx:curl:7.17.0", "cpe:/o:apple:mac_os_x:10.10.3", "cpe:/a:haxx:curl:7.19.1", "cpe:/a:haxx:libcurl:7.13.0", "cpe:/a:haxx:libcurl:7.21.1", "cpe:/a:haxx:libcurl:7.39", "cpe:/a:haxx:curl:7.28.1", "cpe:/a:haxx:libcurl:7.30.0", "cpe:/a:haxx:libcurl:7.21.7", "cpe:/a:haxx:curl:7.10.8", "cpe:/a:haxx:curl:7.19.5", "cpe:/a:haxx:libcurl:7.19.3", "cpe:/a:haxx:curl:7.22.0", "cpe:/a:haxx:libcurl:7.21.5", "cpe:/a:haxx:libcurl:7.10.7", "cpe:/o:apple:mac_os_x:10.10.1", "cpe:/a:haxx:libcurl:7.15.3", "cpe:/a:haxx:libcurl:7.10.6", "cpe:/a:haxx:libcurl:7.18.0", "cpe:/a:haxx:curl:7.28.0", "cpe:/a:haxx:libcurl:7.19.5", "cpe:/a:haxx:libcurl:7.10.8", "cpe:/a:haxx:libcurl:7.37.0", "cpe:/a:haxx:curl:7.16.2", "cpe:/a:haxx:curl:7.12.0", "cpe:/a:haxx:libcurl:7.18.2"], "modified": "2016-08-25T06:51:43", "hash": "0fc072de79fdea5ce61984f4fa40be25f1686e8cfc28aae971e0363d80454ada", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "viewCount": 1, "edition": 1, "assessment": {"name": "", "href": "", "system": ""}, "references": ["http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html", "http://www.securitytracker.com/id/1032232", "http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html", "http://advisories.mageia.org/MGASA-2015-0179.html", "https://support.apple.com/kb/HT205031", "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763", "http://curl.haxx.se/docs/adv_20150422A.html", "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.html", "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html", "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html", "http://www.mandriva.com/security/advisories?name=MDVSA-2015:219", "http://marc.info/?l=bugtraq&m=145612005512270&w=2", "http://www.ubuntu.com/usn/USN-2591-1", "http://www.debian.org/security/2015/dsa-3232", "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html", "http://www.mandriva.com/security/advisories?name=MDVSA-2015:220"], "hashmap": [{"hash": "f52955f97794ee9c7a95312cf001f4ba", "key": "cvelist"}, {"hash": "d59437bc41ec8a74db3504a1b3eb2e54", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "c9c238bb8ce153bfe8809696063334bb", "key": "description"}, {"hash": "dcf1671a73bc352ba4135fef42c537e3", "key": "title"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "dd8a2327867ba6e32f721166a6895c8c", "key": "cpe"}, {"hash": "26769fd423968d45be7383413e2552f1", "key": "cvss"}, {"hash": "8085a92d19ca383d0d074107d7f33bd4", "key": "published"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "5f103ddc59f829e350ab7298868275ef", "key": "references"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "f5d1bfdf7636c93dbcc7070fe1a7d940", "key": "href"}], "lastseen": "2016-09-03T22:28:46", "description": "cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015."}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T22:28:46"}, {"bulletin": {"reporter": "NVD", "published": "2015-04-24T10:59:08", "cvelist": ["CVE-2015-3143"], "title": "CVE-2015-3143", "objectVersion": "1.2", "description": "cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.", "type": "cve", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3143", "bulletinFamily": "NVD", "id": "CVE-2015-3143", "history": [], "scanner": [], "enchantments": {"score": {"modified": "2017-04-18T15:56:45", "value": 6.4}}, "modified": "2017-01-02T22:00:00", "hash": "ecfa5d3c07bdb52e447696b48a5ba6483343b8a585d58e6cd003b996138de807", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "viewCount": 4, "edition": 2, "cpe": ["cpe:/o:apple:mac_os_x:10.10.4", "cpe:/a:haxx:libcurl:7.31.0", "cpe:/a:haxx:curl:7.29.0", "cpe:/a:haxx:libcurl:7.16.0", "cpe:/a:haxx:curl:7.21.1", "cpe:/a:haxx:libcurl:7.41.0", "cpe:/a:haxx:libcurl:7.13.1", "cpe:/a:haxx:curl:7.13.0", "cpe:/a:hp:system_management_homepage:7.5.3.1", "cpe:/a:haxx:curl:7.16.3", "cpe:/a:haxx:curl:7.30.0", "cpe:/a:haxx:curl:7.26.0", "cpe:/o:apple:mac_os_x:10.10.2", "cpe:/a:haxx:libcurl:7.29.0", "cpe:/a:haxx:libcurl:7.16.1", "cpe:/a:haxx:curl:7.19.3", "cpe:/a:haxx:curl:7.18.1", "cpe:/a:haxx:curl:7.15.2", "cpe:/a:haxx:curl:7.19.2", "cpe:/a:haxx:curl:7.24.0", "cpe:/a:haxx:libcurl:7.11.1", "cpe:/a:haxx:libcurl:7.40.0", "cpe:/a:haxx:curl:7.16.4", "cpe:/a:haxx:libcurl:7.18.1", "cpe:/o:canonical:ubuntu_linux:15.04", "cpe:/o:apple:mac_os_x:10.9.5", "cpe:/a:haxx:curl:7.21.5", "cpe:/a:haxx:libcurl:7.19.1", "cpe:/a:haxx:libcurl:7.19.2", "cpe:/a:haxx:libcurl:7.22.0", "cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~", "cpe:/a:haxx:curl:7.13.1", "cpe:/a:haxx:curl:7.35.0", "cpe:/a:haxx:curl:7.10.6", "cpe:/a:haxx:curl:7.21.2", "cpe:/a:haxx:libcurl:7.35.0", "cpe:/a:haxx:libcurl:7.26.0", "cpe:/a:haxx:curl:7.41.0", "cpe:/a:haxx:curl:7.21.4", "cpe:/a:haxx:libcurl:7.25.0", "cpe:/a:haxx:libcurl:7.21.4", "cpe:/a:haxx:curl:7.21.0", "cpe:/a:haxx:libcurl:7.13.2", "cpe:/a:haxx:libcurl:7.34.0", "cpe:/a:haxx:curl:7.15.0", "cpe:/a:haxx:libcurl:7.19.7", "cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~", "cpe:/a:haxx:curl:7.21.7", "cpe:/a:haxx:curl:7.20.0", "cpe:/a:haxx:curl:7.25.0", "cpe:/a:haxx:libcurl:7.12.1", "cpe:/a:haxx:curl:7.19.0", "cpe:/a:haxx:curl:7.12.2", "cpe:/a:haxx:curl:7.16.0", "cpe:/a:haxx:curl:7.40.0", "cpe:/a:haxx:curl:7.10.7", "cpe:/a:haxx:libcurl:7.15.5", "cpe:/a:haxx:libcurl:7.33.0", "cpe:/a:haxx:curl:7.34.0", "cpe:/a:haxx:curl:7.18.2", "cpe:/a:haxx:curl:7.18.0", "cpe:/a:haxx:curl:7.19.7", "cpe:/a:haxx:libcurl:7.20.0", "cpe:/a:haxx:libcurl:7.32.0", "cpe:/a:haxx:libcurl:7.12.2", "cpe:/a:haxx:curl:7.16.1", "cpe:/a:haxx:libcurl:7.16.2", "cpe:/a:haxx:curl:7.27.0", "cpe:/a:haxx:libcurl:7.15.4", "cpe:/a:haxx:curl:7.21.6", "cpe:/a:haxx:libcurl:7.19.6", "cpe:/a:haxx:curl:7.23.1", "cpe:/a:haxx:libcurl:7.28.0", "cpe:/a:haxx:libcurl:7.15.2", "cpe:/a:haxx:libcurl:7.19.0", "cpe:/a:haxx:libcurl:7.19.4", "cpe:/a:haxx:curl:7.36.0", "cpe:/a:haxx:libcurl:7.15.0", "cpe:/a:haxx:libcurl:7.21.0", "cpe:/a:haxx:curl:7.31.0", "cpe:/a:haxx:curl:7.15.4", "cpe:/a:haxx:curl:7.11.0", "cpe:/a:haxx:libcurl:7.11.0", "cpe:/a:haxx:libcurl:7.12.0", "cpe:/a:haxx:libcurl:7.24.0", "cpe:/a:haxx:libcurl:7.36.0", "cpe:/a:haxx:libcurl:7.37.1", "cpe:/o:canonical:ubuntu_linux:14.10", "cpe:/a:haxx:libcurl:7.16.3", "cpe:/a:haxx:curl:7.19.6", "cpe:/a:haxx:libcurl:7.14.1", "cpe:/a:haxx:libcurl:7.21.6", "cpe:/a:haxx:libcurl:7.12.3", "cpe:/a:haxx:libcurl:7.23.0", "cpe:/a:haxx:curl:7.15.1", "cpe:/a:haxx:libcurl:7.38.0", "cpe:/a:haxx:libcurl:7.17.0", "cpe:/a:haxx:curl:7.39.0", "cpe:/a:haxx:curl:7.17.1", "cpe:/a:haxx:curl:7.15.3", "cpe:/a:haxx:libcurl:7.27.0", "cpe:/a:haxx:curl:7.32.0", "cpe:/a:haxx:libcurl:7.28.1", "cpe:/a:haxx:libcurl:7.11.2", "cpe:/a:haxx:curl:7.37.1", "cpe:/a:haxx:libcurl:7.16.4", "cpe:/a:haxx:curl:7.23.0", "cpe:/a:haxx:curl:7.15.5", "cpe:/a:haxx:curl:7.14.1", "cpe:/a:haxx:curl:7.14.0", "cpe:/a:haxx:libcurl:7.17.1", "cpe:/a:haxx:curl:7.11.2", "cpe:/a:haxx:curl:7.11.1", "cpe:/a:haxx:curl:7.38.0", "cpe:/a:haxx:libcurl:7.21.2", "cpe:/a:haxx:curl:7.12.1", "cpe:/o:debian:debian_linux:7.0", "cpe:/a:haxx:libcurl:7.14.0", "cpe:/a:haxx:curl:7.20.1", "cpe:/a:haxx:curl:7.33.0", "cpe:/a:haxx:libcurl:7.21.3", "cpe:/a:haxx:curl:7.19.4", "cpe:/a:haxx:curl:7.21.3", "cpe:/o:apple:mac_os_x:10.10.0", "cpe:/a:haxx:curl:7.13.2", "cpe:/a:haxx:libcurl:7.23.1", "cpe:/a:haxx:curl:7.12.3", "cpe:/a:haxx:libcurl:7.20.1", "cpe:/a:haxx:libcurl:7.15.1", "cpe:/a:haxx:curl:7.17.0", "cpe:/o:apple:mac_os_x:10.10.3", "cpe:/a:haxx:curl:7.19.1", "cpe:/a:haxx:libcurl:7.13.0", "cpe:/a:haxx:libcurl:7.21.1", "cpe:/a:haxx:libcurl:7.39", "cpe:/a:haxx:curl:7.28.1", "cpe:/a:haxx:libcurl:7.30.0", "cpe:/a:haxx:libcurl:7.21.7", "cpe:/a:haxx:curl:7.10.8", "cpe:/a:haxx:curl:7.19.5", "cpe:/a:haxx:libcurl:7.19.3", "cpe:/a:haxx:curl:7.22.0", "cpe:/a:haxx:libcurl:7.21.5", "cpe:/a:haxx:libcurl:7.10.7", "cpe:/o:apple:mac_os_x:10.10.1", "cpe:/a:haxx:libcurl:7.15.3", "cpe:/a:haxx:libcurl:7.10.6", "cpe:/a:haxx:libcurl:7.18.0", "cpe:/a:haxx:curl:7.28.0", "cpe:/a:haxx:libcurl:7.19.5", "cpe:/a:haxx:libcurl:7.10.8", "cpe:/a:haxx:libcurl:7.37.0", "cpe:/a:haxx:curl:7.16.2", "cpe:/a:haxx:curl:7.12.0", "cpe:/a:haxx:libcurl:7.18.2"], "references": ["http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html", "http://www.securitytracker.com/id/1032232", "http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html", "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html", "http://advisories.mageia.org/MGASA-2015-0179.html", "https://support.apple.com/kb/HT205031", "http://www.securityfocus.com/bid/74299", "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743", "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763", "http://curl.haxx.se/docs/adv_20150422A.html", "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.html", "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html", "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156250.html", "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html", "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html", "http://www.mandriva.com/security/advisories?name=MDVSA-2015:219", "http://marc.info/?l=bugtraq&m=145612005512270&w=2", "https://security.gentoo.org/glsa/201509-02", "http://www.ubuntu.com/usn/USN-2591-1", "http://www.debian.org/security/2015/dsa-3232", "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html", "http://www.mandriva.com/security/advisories?name=MDVSA-2015:220"], "hashmap": [{"hash": "f52955f97794ee9c7a95312cf001f4ba", "key": "cvelist"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "c9c238bb8ce153bfe8809696063334bb", "key": "description"}, {"hash": "dcf1671a73bc352ba4135fef42c537e3", "key": "title"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "dd8a2327867ba6e32f721166a6895c8c", "key": "cpe"}, {"hash": "26769fd423968d45be7383413e2552f1", "key": "cvss"}, {"hash": "8085a92d19ca383d0d074107d7f33bd4", "key": "published"}, {"hash": "7b181d95210faba8aa974c40403c5793", "key": "modified"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "63aff13fa6c3cea122ff3dff235486d0", "key": "references"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "f5d1bfdf7636c93dbcc7070fe1a7d940", "key": "href"}], "lastseen": "2017-04-18T15:56:45", "assessment": {"name": "", "href": "", "system": ""}}, "differentElements": ["references", "modified"], "edition": 2, "lastseen": "2017-04-18T15:56:45"}], "scanner": [], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "modified": "2018-01-04T21:30:04", "hash": "091adf25a798d6975306645490ced5f9c7f9ee4e3e0d7cbc2cc8b41bb9dbd802", "enchantments": {"score": {"vector": "NONE", "value": 5.0}, "dependencies": {"references": [{"type": "f5", "idList": ["F5:K16704", "SOL16704"]}, {"type": "nessus", "idList": ["DEBIAN_DLA-211.NASL", "F5_BIGIP_SOL16704.NASL", "MANDRIVA_MDVSA-2015-220.NASL", "FEDORA_2015-6712.NASL", "MANDRIVA_MDVSA-2015-219.NASL", "SUSE_SU-2015-0962-1.NASL", "UBUNTU_USN-2591-1.NASL", "SUSE_SU-2015-0990-1.NASL", "CENTOS_RHSA-2015-2159.NASL", "FEDORA_2015-6695.NASL"]}, {"type": "debian", "idList": ["DEBIAN:DLA-211-1:EE6A6", "DEBIAN:DSA-3232-1:8267A"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:31964", "SECURITYVULNS:DOC:31976", "SECURITYVULNS:VULN:13544", "SECURITYVULNS:VULN:14630", "SECURITYVULNS:DOC:32390"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310123056", "OPENVAS:1361412562310842186", "OPENVAS:1361412562310871401", "OPENVAS:1361412562310869729", "OPENVAS:703232", "OPENVAS:1361412562310869334", "OPENVAS:1361412562310869500", "OPENVAS:1361412562310703232", "OPENVAS:1361412562310120531", "OPENVAS:1361412562310122761"]}, {"type": "kaspersky", "idList": ["KLA10566"]}, {"type": "centos", "idList": ["CESA-2015:1254", "CESA-2015:2159"]}, {"type": "archlinux", "idList": ["ASA-201504-28"]}, {"type": "oraclelinux", "idList": ["ELSA-2015-2159", "ELSA-2015-1254"]}, {"type": "redhat", "idList": ["RHSA-2015:2159", "RHSA-2015:1254"]}, {"type": "ubuntu", "idList": ["USN-2591-1"]}, {"type": "amazon", "idList": ["ALAS-2015-514"]}, {"type": "slackware", "idList": ["SSA-2015-302-01"]}, {"type": "gentoo", "idList": ["GLSA-201509-02"]}], "modified": "2018-01-05T11:51:39"}, "vulnersScore": 5.0}, "edition": 3, "description": "cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.", "references": ["http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html", "http://www.securitytracker.com/id/1032232", "http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html", "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html", "http://rhn.redhat.com/errata/RHSA-2015-1254.html", "http://advisories.mageia.org/MGASA-2015-0179.html", "https://support.apple.com/kb/HT205031", "http://www.securityfocus.com/bid/74299", "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743", "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763", "http://curl.haxx.se/docs/adv_20150422A.html", "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.html", "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html", "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156250.html", "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html", "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html", "http://www.mandriva.com/security/advisories?name=MDVSA-2015:219", "http://marc.info/?l=bugtraq&m=145612005512270&w=2", "https://security.gentoo.org/glsa/201509-02", "http://www.ubuntu.com/usn/USN-2591-1", "http://www.debian.org/security/2015/dsa-3232", "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html", "http://www.mandriva.com/security/advisories?name=MDVSA-2015:220"], "id": "CVE-2015-3143", "lastseen": "2018-01-05T11:51:39", "assessment": {"name": "", "href": "", "system": ""}}

{"f5": [{"lastseen": "2019-02-16T04:37:20", "bulletinFamily": "software", "description": "\nF5 Product Development has assigned ID 521026 (BIG-IP), ID 525347 (BIG-IQ), ID 525348 (Enterprise Manager), and ID 476510 (ARX) to this vulnerability, and has evaluated the currently supported releases for potential vulnerability. Additionally, [BIG-IP iHealth](<http://www.f5.com/support/support-tools/big-ip-ihealth/>) may list Heuristic H16704 on the **Diagnostics** &gt; **Identified** &gt; **Low** screen.\n\nTo determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table:\n\nProduct| Versions known to be vulnerable| Versions known to be not vulnerable| Severity| Vulnerable component or feature \n---|---|---|---|--- \nBIG-IP LTM| 12.0.0 \n11.0.0 - 11.6.1 \n10.0.0 - 10.2.4| 12.1.0 \n11.6.1 HF1 \n11.5.4 HF2| Low| cURL and libcurl* \nBIG-IP AAM| 12.0.0 \n11.4.0 - 11.6.1| 12.1.0 \n11.6.1 HF1 \n11.5.4 HF2| Low| cURL and libcurl* \nBIG-IP AFM| 12.0.0 \n11.3.0 - 11.6.1| 12.1.0 \n11.6.1 HF1 \n11.5.4 HF2| Low| cURL and libcurl* \nBIG-IP Analytics| 12.0.0 \n11.0.0 - 11.6.1| 12.1.0 \n11.6.1 HF1 \n11.5.4 HF2| Low| cURL and libcurl* \nBIG-IP APM| 12.0.0 \n11.0.0 - 11.6.1 \n10.1.0 - 10.2.4| 12.1.0 \n11.6.1 HF1 \n11.5.4 HF2| Low| cURL and libcurl* \nBIG-IP ASM| 12.0.0 \n11.0.0 - 11.6.1 \n10.0.0 - 10.2.4| 12.1.0 \n11.6.1 HF1 \n11.5.4 HF2| Low| cURL and libcurl* \nBIG-IP DNS| 12.0.0| 12.1.0| | \nBIG-IP Edge Gateway| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4| None| Low| cURL and libcurl* \nBIG-IP GTM| 11.0.0 - 11.6.1 \n10.0.0 - 10.2.4| 11.6.1 HF1 \n11.5.4 HF2| Low| cURL and libcurl* \nBIG-IP Link Controller| 12.0.0 \n11.0.0 - 11.6.1 \n10.0.0 - 10.2.4| 12.1.0 \n11.6.1 HF1 \n11.5.4 HF2| Low| cURL and libcurl* \nBIG-IP PEM| 12.0.0 \n11.3.0 - 11.6.1| 12.1.0 \n11.6.1 HF1 \n11.5.4 HF2| Low| cURL and libcurl* \nBIG-IP PSM| 11.0.0 - 11.4.1 \n10.0.0 - 10.2.4| None| Low| cURL and libcurl* \nBIG-IP WebAccelerator| 11.0.0 - 11.3.0 \n10.0.0 - 10.2.4| None| Low| cURL and libcurl* \nBIG-IP WOM| 11.0.0 - 11.3.0 \n10.0.0 - 10.2.4| None| Low| cURL and libcurl* \nARX| 6.0.0 - 6.4.0| None| Low| cURL and libcurl \nEnterprise Manager| 3.0.0 - 3.1.1 \n2.1.0 - 2.3.0| None| Low| cURL and libcurl \nFirePass| None| 7.0.0 \n6.0.0 - 6.1.0| Not vulnerable| None \nBIG-IQ Cloud| 4.0.0 - 4.5.0| None| Low| cURL and libcurl \nBIG-IQ Device| 4.2.0 - 4.5.0| None| Low| cURL and libcurl \nBIG-IQ Security| 4.0.0 - 4.5.0| None| Low| cURL and libcurl \nBIG-IQ ADC| 4.5.0| None| Low| cURL and libcurl \nLineRate| None| 2.4.0 - 2.6.0| Not vulnerable| None \nF5 WebSafe| None| 1.0.0| Not vulnerable| None \nTraffix SDC| None| 4.0.0 - 4.1.0 \n3.3.2 - 3.5.1| Not vulnerable| None \n \n*****The cURL libraries and use of NTLM are not exposed in BIG-IP standard monitors. Custom EAV monitors, using cURL and NTLM, may be prone to this vulnerability.\n\n**Note**: As of February 17, 2015, AskF5 Security Advisory articles include the **Severity** value. Security Advisory articles published before this date do not list a **Severity** value.\n\nIf the previous table lists a version in the **Versions known to be not vulnerable** column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version in the column, then no upgrade candidate currently exists.\n\n**ARX**\n\nIf the previous table lists a version in the **Versions known to be not vulnerable** column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, then no upgrade candidate currently exists.\n\nTo mitigate this vulnerability, do not enable the API functionality.\n\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n * [K167: Downloading software and firmware from F5](<https://support.f5.com/csp/article/K167>)\n * [K13123: Managing BIG-IP product hotfixes (11.x - 13.x)](<https://support.f5.com/csp/article/K13123>)\n", "modified": "2018-02-06T01:02:00", "published": "2015-05-29T22:02:00", "id": "F5:K16704", "href": "https://support.f5.com/csp/article/K16704", "title": "cURL and libcurl vulnerability CVE-2015-3143", "type": "f5", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2016-11-09T00:09:58", "bulletinFamily": "software", "description": "**Note**: As of February 17, 2015, AskF5 Security Advisory articles include the **Severity** value. Security Advisory articles published before this date do not list a **Severity** value.\n\nVulnerability Recommended Actions\n\nIf the previous table lists a version in the **Versions known to be not vulnerable** column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version in the column, then no upgrade candidate currently exists.\n\n**ARX**\n\nIf the previous table lists a version in the **Versions known to be not vulnerable** column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, then no upgrade candidate currently exists.\n\nTo mitigate this vulnerability, do not enable the API functionality.\n\nSupplemental Information\n\n * SOL9970: Subscribing to email notifications regarding F5 products\n * SOL9957: Creating a custom RSS feed to view new and updated documents\n * SOL4602: Overview of the F5 security vulnerability response policy\n * SOL4918: Overview of the F5 critical issue hotfix policy\n * SOL167: Downloading software and firmware from F5\n * SOL13123: Managing BIG-IP product hotfixes (11.x - 12.x)\n", "modified": "2016-08-24T00:00:00", "published": "2015-05-29T00:00:00", "href": "http://support.f5.com/kb/en-us/solutions/public/16000/700/sol16704.html", "id": "SOL16704", "title": "SOL16704 - cURL and libcurl vulnerability CVE-2015-3143", "type": "f5", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "nessus": [{"lastseen": "2019-01-16T20:26:33", "bulletinFamily": "scanner", "description": "cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM\nconnections, which allows remote attackers to connect as other users\nvia an unauthenticated request, a similar issue to CVE-2014-0015.\n(CVE-2015-3143)", "modified": "2019-01-04T00:00:00", "published": "2017-04-06T00:00:00", "id": "F5_BIGIP_SOL16704.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=99203", "title": "F5 Networks BIG-IP : cURL and libcurl vulnerability (K16704)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from F5 Networks BIG-IP Solution K16704.\n#\n# The text description of this plugin is (C) F5 Networks.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(99203);\n script_version(\"3.3\");\n script_cvs_date(\"Date: 2019/01/04 10:03:40\");\n\n script_cve_id(\"CVE-2014-0015\", \"CVE-2015-3143\");\n script_bugtraq_id(65270, 74299);\n\n script_name(english:\"F5 Networks BIG-IP : cURL and libcurl vulnerability (K16704)\");\n script_summary(english:\"Checks the BIG-IP version.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote device is missing a vendor-supplied security patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM\nconnections, which allows remote attackers to connect as other users\nvia an unauthenticated request, a similar issue to CVE-2014-0015.\n(CVE-2015-3143)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://support.f5.com/csp/article/K16704\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade to one of the non-vulnerable versions listed in the F5\nSolution K16704.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_access_policy_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_advanced_firewall_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_application_acceleration_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_application_security_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_application_visibility_and_reporting\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_global_traffic_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_link_controller\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_local_traffic_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_policy_enforcement_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_wan_optimization_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_webaccelerator\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/h:f5:big-ip\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/h:f5:big-ip_protocol_security_manager\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/05/29\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/04/06\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"F5 Networks Local Security Checks\");\n\n script_dependencies(\"f5_bigip_detect.nbin\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/BIG-IP/hotfix\", \"Host/BIG-IP/modules\", \"Host/BIG-IP/version\", \"Settings/ParanoidReport\");\n\n exit(0);\n}\n\n\ninclude(\"f5_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nversion = get_kb_item(\"Host/BIG-IP/version\");\nif ( ! version ) audit(AUDIT_OS_NOT, \"F5 Networks BIG-IP\");\nif ( isnull(get_kb_item(\"Host/BIG-IP/hotfix\")) ) audit(AUDIT_KB_MISSING, \"Host/BIG-IP/hotfix\");\nif ( ! get_kb_item(\"Host/BIG-IP/modules\") ) audit(AUDIT_KB_MISSING, \"Host/BIG-IP/modules\");\n\nsol = \"K16704\";\nvmatrix = make_array();\n\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\n\n# AFM\nvmatrix[\"AFM\"] = make_array();\nvmatrix[\"AFM\"][\"affected\" ] = make_list(\"12.0.0\",\"11.3.0-11.6.1\");\nvmatrix[\"AFM\"][\"unaffected\"] = make_list(\"12.1.0\",\"11.6.1HF1\",\"11.5.4HF2\");\n\n# AM\nvmatrix[\"AM\"] = make_array();\nvmatrix[\"AM\"][\"affected\" ] = make_list(\"12.0.0\",\"11.4.0-11.6.1\");\nvmatrix[\"AM\"][\"unaffected\"] = make_list(\"12.1.0\",\"11.6.1HF1\",\"11.5.4HF2\");\n\n# APM\nvmatrix[\"APM\"] = make_array();\nvmatrix[\"APM\"][\"affected\" ] = make_list(\"12.0.0\",\"11.0.0-11.6.1\",\"10.1.0-10.2.4\");\nvmatrix[\"APM\"][\"unaffected\"] = make_list(\"12.1.0\",\"11.6.1HF1\",\"11.5.4HF2\");\n\n# ASM\nvmatrix[\"ASM\"] = make_array();\nvmatrix[\"ASM\"][\"affected\" ] = make_list(\"12.0.0\",\"11.0.0-11.6.1\",\"10.0.0-10.2.4\");\nvmatrix[\"ASM\"][\"unaffected\"] = make_list(\"12.1.0\",\"11.6.1HF1\",\"11.5.4HF2\");\n\n# AVR\nvmatrix[\"AVR\"] = make_array();\nvmatrix[\"AVR\"][\"affected\" ] = make_list(\"12.0.0\",\"11.0.0-11.6.1\");\nvmatrix[\"AVR\"][\"unaffected\"] = make_list(\"12.1.0\",\"11.6.1HF1\",\"11.5.4HF2\");\n\n# GTM\nvmatrix[\"GTM\"] = make_array();\nvmatrix[\"GTM\"][\"affected\" ] = make_list(\"11.0.0-11.6.1\",\"10.0.0-10.2.4\");\nvmatrix[\"GTM\"][\"unaffected\"] = make_list(\"11.6.1HF1\",\"11.5.4HF2\");\n\n# LC\nvmatrix[\"LC\"] = make_array();\nvmatrix[\"LC\"][\"affected\" ] = make_list(\"12.0.0\",\"11.0.0-11.6.1\",\"10.0.0-10.2.4\");\nvmatrix[\"LC\"][\"unaffected\"] = make_list(\"12.1.0\",\"11.6.1HF1\",\"11.5.4HF2\");\n\n# LTM\nvmatrix[\"LTM\"] = make_array();\nvmatrix[\"LTM\"][\"affected\" ] = make_list(\"12.0.0\",\"11.0.0-11.6.1\",\"10.0.0-10.2.4\");\nvmatrix[\"LTM\"][\"unaffected\"] = make_list(\"12.1.0\",\"11.6.1HF1\",\"11.5.4HF2\");\n\n# PEM\nvmatrix[\"PEM\"] = make_array();\nvmatrix[\"PEM\"][\"affected\" ] = make_list(\"12.0.0\",\"11.3.0-11.6.1\");\nvmatrix[\"PEM\"][\"unaffected\"] = make_list(\"12.1.0\",\"11.6.1HF1\",\"11.5.4HF2\");\n\n\nif (bigip_is_affected(vmatrix:vmatrix, sol:sol))\n{\n if (report_verbosity > 0) security_warning(port:0, extra:bigip_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = bigip_get_tested_modules();\n audit_extra = \"For BIG-IP module(s) \" + tested + \",\";\n if (tested) audit(AUDIT_INST_VER_NOT_VULN, audit_extra, version);\n else audit(AUDIT_HOST_NOT, \"running any of the affected modules\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2019-01-16T20:21:25", "bulletinFamily": "scanner", "description": "Several vulnerabilities were discovered in cURL, an URL transfer\nlibrary :\n\nCVE-2015-3143\n\nNTLM-authenticated connections could be wrongly reused for requests\nwithout any credentials set, leading to HTTP requests being sent over\nthe connection authenticated as a different user. This is similar to\nthe issue fixed in DSA-2849-1.\n\nCVE-2015-3148\n\nWhen doing HTTP requests using the Negotiate authentication method\nalong with NTLM, the connection used would not be marked as\nauthenticated, making it possible to reuse it and send requests for\none user over the connection authenticated as a different user.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.", "modified": "2018-07-06T00:00:00", "published": "2015-04-30T00:00:00", "id": "DEBIAN_DLA-211.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=83143", "title": "Debian DLA-211-1 : curl security update", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-211-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(83143);\n script_version(\"2.5\");\n script_cvs_date(\"Date: 2018/07/06 11:26:06\");\n\n script_cve_id(\"CVE-2015-3143\", \"CVE-2015-3148\");\n script_bugtraq_id(74299, 74301);\n\n script_name(english:\"Debian DLA-211-1 : curl security update\");\n script_summary(english:\"Checks dpkg output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities were discovered in cURL, an URL transfer\nlibrary :\n\nCVE-2015-3143\n\nNTLM-authenticated connections could be wrongly reused for requests\nwithout any credentials set, leading to HTTP requests being sent over\nthe connection authenticated as a different user. This is similar to\nthe issue fixed in DSA-2849-1.\n\nCVE-2015-3148\n\nWhen doing HTTP requests using the Negotiate authentication method\nalong with NTLM, the connection used would not be marked as\nauthenticated, making it possible to reuse it and send requests for\none user over the connection authenticated as a different user.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2015/04/msg00024.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze-lts/curl\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libcurl3\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libcurl3-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libcurl3-gnutls\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libcurl4-gnutls-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libcurl4-openssl-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/04/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/04/30\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"curl\", reference:\"7.21.0-2.1+squeeze12\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libcurl3\", reference:\"7.21.0-2.1+squeeze12\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libcurl3-dbg\", reference:\"7.21.0-2.1+squeeze12\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libcurl3-gnutls\", reference:\"7.21.0-2.1+squeeze12\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libcurl4-gnutls-dev\", reference:\"7.21.0-2.1+squeeze12\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libcurl4-openssl-dev\", reference:\"7.21.0-2.1+squeeze12\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2019-01-16T20:21:26", "bulletinFamily": "scanner", "description": "Updated curl packages fix security vulnerabilities :\n\nNTLM-authenticated connections could be wrongly reused for requests\nwithout any credentials set, leading to HTTP requests being sent over\nthe connection authenticated as a different user (CVE-2015-3143).\n\nWhen doing HTTP requests using the Negotiate authentication method\nalong with NTLM, the connection used would not be marked as\nauthenticated, making it possible to reuse it and send requests for\none user over the connection authenticated as a different user\n(CVE-2015-3148).", "modified": "2018-07-19T00:00:00", "published": "2015-05-05T00:00:00", "id": "MANDRIVA_MDVSA-2015-220.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=83244", "title": "Mandriva Linux Security Advisory : curl (MDVSA-2015:220)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 70103\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2015:220. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(83244);\n script_version(\"2.2\");\n script_cvs_date(\"Date: 2018/07/19 20:59:19\");\n\n script_cve_id(\"CVE-2015-3143\", \"CVE-2015-3148\");\n script_bugtraq_id(74299, 74301);\n script_xref(name:\"MDVSA\", value:\"2015:220\");\n\n script_name(english:\"Mandriva Linux Security Advisory : curl (MDVSA-2015:220)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated curl packages fix security vulnerabilities :\n\nNTLM-authenticated connections could be wrongly reused for requests\nwithout any credentials set, leading to HTTP requests being sent over\nthe connection authenticated as a different user (CVE-2015-3143).\n\nWhen doing HTTP requests using the Negotiate authentication method\nalong with NTLM, the connection used would not be marked as\nauthenticated, making it possible to reuse it and send requests for\none user over the connection authenticated as a different user\n(CVE-2015-3148).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://advisories.mageia.org/MGASA-2015-0179.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:curl-examples\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64curl-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64curl4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:business_server:1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/05/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/05/05\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"curl-7.24.0-3.9.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"curl-examples-7.24.0-3.9.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"lib64curl-devel-7.24.0-3.9.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"lib64curl4-7.24.0-3.9.mbs1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2019-01-16T20:21:38", "bulletinFamily": "scanner", "description": "The curl tool and libcurl4 library have been updated to fix several\nsecurity and non-security issues.\n\nThe following vulnerabilities have been fixed :\n\nCVE-2015-3143: Re-using authenticated connection when unauthenticated.\n(bsc#927556)\n\nCVE-2015-3148: Negotiate not treated as connection-oriented.\n(bsc#927746)\n\nCVE-2015-3153: Sensitive HTTP server headers also sent to proxies.\n(bsc#928533)\n\nThe following non-security issue has been fixed :\n\ngit fails to clone from https repository. (bsc#927174)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "modified": "2018-11-29T00:00:00", "published": "2015-05-29T00:00:00", "id": "SUSE_SU-2015-0962-1.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=83903", "title": "SUSE SLED11 / SLES11 Security Update : curl (SUSE-SU-2015:0962-1)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2015:0962-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(83903);\n script_version(\"2.9\");\n script_cvs_date(\"Date: 2018/11/29 12:03:38\");\n\n script_cve_id(\"CVE-2015-3143\", \"CVE-2015-3148\", \"CVE-2015-3153\");\n script_bugtraq_id(74299, 74301, 74408);\n\n script_name(english:\"SUSE SLED11 / SLES11 Security Update : curl (SUSE-SU-2015:0962-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The curl tool and libcurl4 library have been updated to fix several\nsecurity and non-security issues.\n\nThe following vulnerabilities have been fixed :\n\nCVE-2015-3143: Re-using authenticated connection when unauthenticated.\n(bsc#927556)\n\nCVE-2015-3148: Negotiate not treated as connection-oriented.\n(bsc#927746)\n\nCVE-2015-3153: Sensitive HTTP server headers also sent to proxies.\n(bsc#928533)\n\nThe following non-security issue has been fixed :\n\ngit fails to clone from https repository. (bsc#927174)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=927174\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=927556\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=927746\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=928533\"\n );\n # https://download.suse.com/patch/finder/?keywords=15283cac05d947363283c7ddcb466af0\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?386b8563\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-3143/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-3148/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-3153/\"\n );\n # https://www.suse.com/support/update/announcement/2015/suse-su-20150962-1.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?0afcc3ad\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Software Development Kit 11 SP3 :\n\nzypper in -t patch sdksp3-curl=10660\n\nSUSE Linux Enterprise Server 11 SP3 for VMware :\n\nzypper in -t patch slessp3-curl=10660\n\nSUSE Linux Enterprise Server 11 SP3 :\n\nzypper in -t patch slessp3-curl=10660\n\nSUSE Linux Enterprise Desktop 11 SP3 :\n\nzypper in -t patch sledsp3-curl=10660\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libcurl4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/05/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/05/29\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = eregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^(SLED11|SLES11)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED11 / SLES11\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES11\" && (! ereg(pattern:\"^(3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES11 SP3\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED11\" && (! ereg(pattern:\"^(3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED11 SP3\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"x86_64\", reference:\"libcurl4-32bit-7.19.7-1.42.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"s390x\", reference:\"libcurl4-32bit-7.19.7-1.42.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", reference:\"curl-7.19.7-1.42.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", reference:\"libcurl4-7.19.7-1.42.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"3\", cpu:\"x86_64\", reference:\"curl-7.19.7-1.42.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"3\", cpu:\"x86_64\", reference:\"libcurl4-7.19.7-1.42.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"3\", cpu:\"x86_64\", reference:\"libcurl4-32bit-7.19.7-1.42.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"3\", cpu:\"i586\", reference:\"curl-7.19.7-1.42.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:\"3\", cpu:\"i586\", reference:\"libcurl4-7.19.7-1.42.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"curl\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2019-01-16T20:21:24", "bulletinFamily": "scanner", "description": "- require credentials to match for NTLM re-use\n (CVE-2015-3143)\n\n - fix invalid write in cookie path sanitization code\n (CVE-2015-3145)\n\n - close Negotiate connections when done (CVE-2015-3148)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "modified": "2015-10-19T00:00:00", "published": "2015-04-29T00:00:00", "id": "FEDORA_2015-6712.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=83128", "title": "Fedora 20 : curl-7.32.0-20.fc20 (2015-6712)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2015-6712.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(83128);\n script_version(\"$Revision: 2.2 $\");\n script_cvs_date(\"$Date: 2015/10/19 23:14:52 $\");\n\n script_cve_id(\"CVE-2015-3143\", \"CVE-2015-3145\", \"CVE-2015-3148\");\n script_xref(name:\"FEDORA\", value:\"2015-6712\");\n\n script_name(english:\"Fedora 20 : curl-7.32.0-20.fc20 (2015-6712)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - require credentials to match for NTLM re-use\n (CVE-2015-3143)\n\n - fix invalid write in cookie path sanitization code\n (CVE-2015-3145)\n\n - close Negotiate connections when done (CVE-2015-3148)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1213306\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1213347\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1213351\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2015-April/156250.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?26e7692e\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected curl package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:20\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/04/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/04/29\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^20([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 20.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC20\", reference:\"curl-7.32.0-20.fc20\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"curl\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-01-16T20:21:26", "bulletinFamily": "scanner", "description": "Updated curl packages fix security vulnerabilities :\n\nNTLM-authenticated connections could be wrongly reused for requests\nwithout any credentials set, leading to HTTP requests being sent over\nthe connection authenticated as a different user (CVE-2015-3143).\n\nWhen parsing HTTP cookies, if the parsed cookie's path element\nconsists of a single double-quote, libcurl would try to write to an\ninvalid heap memory address. This could allow remote attackers to\ncause a denial of service (crash) (CVE-2015-3145).\n\nWhen doing HTTP requests using the Negotiate authentication method\nalong with NTLM, the connection used would not be marked as\nauthenticated, making it possible to reuse it and send requests for\none user over the connection authenticated as a different user\n(CVE-2015-3148).", "modified": "2018-07-19T00:00:00", "published": "2015-05-05T00:00:00", "id": "MANDRIVA_MDVSA-2015-219.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=83243", "title": "Mandriva Linux Security Advisory : curl (MDVSA-2015:219)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 70103\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2015:219. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(83243);\n script_version(\"2.2\");\n script_cvs_date(\"Date: 2018/07/19 20:59:19\");\n\n script_cve_id(\"CVE-2015-3143\", \"CVE-2015-3145\", \"CVE-2015-3148\");\n script_xref(name:\"MDVSA\", value:\"2015:219\");\n\n script_name(english:\"Mandriva Linux Security Advisory : curl (MDVSA-2015:219)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated curl packages fix security vulnerabilities :\n\nNTLM-authenticated connections could be wrongly reused for requests\nwithout any credentials set, leading to HTTP requests being sent over\nthe connection authenticated as a different user (CVE-2015-3143).\n\nWhen parsing HTTP cookies, if the parsed cookie's path element\nconsists of a single double-quote, libcurl would try to write to an\ninvalid heap memory address. This could allow remote attackers to\ncause a denial of service (crash) (CVE-2015-3145).\n\nWhen doing HTTP requests using the Negotiate authentication method\nalong with NTLM, the connection used would not be marked as\nauthenticated, making it possible to reuse it and send requests for\none user over the connection authenticated as a different user\n(CVE-2015-3148).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://advisories.mageia.org/MGASA-2015-0179.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:curl-examples\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64curl-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64curl4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:business_server:2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/05/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/05/05\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK-MBS2\", cpu:\"x86_64\", reference:\"curl-7.34.0-3.2.mbs2\")) flag++;\nif (rpm_check(release:\"MDK-MBS2\", reference:\"curl-examples-7.34.0-3.2.mbs2\")) flag++;\nif (rpm_check(release:\"MDK-MBS2\", cpu:\"x86_64\", reference:\"lib64curl-devel-7.34.0-3.2.mbs2\")) flag++;\nif (rpm_check(release:\"MDK-MBS2\", cpu:\"x86_64\", reference:\"lib64curl4-7.34.0-3.2.mbs2\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-01-16T20:21:25", "bulletinFamily": "scanner", "description": "Update to 7.42.0 which fixes various CVE's\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "modified": "2015-11-06T00:00:00", "published": "2015-05-05T00:00:00", "id": "FEDORA_2015-6853.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=83237", "title": "Fedora 21 : mingw-curl-7.42.0-1.fc21 (2015-6853)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2015-6853.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(83237);\n script_version(\"$Revision: 2.3 $\");\n script_cvs_date(\"$Date: 2015/11/06 14:51:23 $\");\n\n script_cve_id(\"CVE-2014-8150\", \"CVE-2015-3143\", \"CVE-2015-3144\", \"CVE-2015-3145\", \"CVE-2015-3148\");\n script_xref(name:\"FEDORA\", value:\"2015-6853\");\n\n script_name(english:\"Fedora 21 : mingw-curl-7.42.0-1.fc21 (2015-6853)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Update to 7.42.0 which fixes various CVE's\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1180063\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1214795\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?fdd430cc\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected mingw-curl package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:mingw-curl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:21\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/04/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/05/05\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^21([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 21.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC21\", reference:\"mingw-curl-7.42.0-1.fc21\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"mingw-curl\");\n}\n", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-01-16T20:21:24", "bulletinFamily": "scanner", "description": "- require credentials to match for NTLM re-use\n (CVE-2015-3143)\n\n - fix invalid write with a zero-length host name in URL\n (CVE-2015-3144)\n\n - fix invalid write in cookie path sanitization code\n (CVE-2015-3145)\n\n - close Negotiate connections when done (CVE-2015-3148)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "modified": "2015-11-06T00:00:00", "published": "2015-04-27T00:00:00", "id": "FEDORA_2015-6695.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=83078", "title": "Fedora 22 : curl-7.40.0-3.fc22 (2015-6695)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2015-6695.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(83078);\n script_version(\"$Revision: 2.4 $\");\n script_cvs_date(\"$Date: 2015/11/06 14:51:23 $\");\n\n script_cve_id(\"CVE-2015-3143\", \"CVE-2015-3144\", \"CVE-2015-3145\", \"CVE-2015-3148\");\n script_xref(name:\"FEDORA\", value:\"2015-6695\");\n\n script_name(english:\"Fedora 22 : curl-7.40.0-3.fc22 (2015-6695)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - require credentials to match for NTLM re-use\n (CVE-2015-3143)\n\n - fix invalid write with a zero-length host name in URL\n (CVE-2015-3144)\n\n - fix invalid write in cookie path sanitization code\n (CVE-2015-3145)\n\n - close Negotiate connections when done (CVE-2015-3148)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1213306\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1213335\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1213347\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1213351\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?bf32e6c7\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected curl package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:22\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/04/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/04/27\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^22([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 22.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC22\", reference:\"curl-7.40.0-3.fc22\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"curl\");\n}\n", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-01-16T20:21:25", "bulletinFamily": "scanner", "description": "curl was updated to fix four security issues.\n\nThe following vulnerabilities were fixed :\n\n - CVE-2015-3143: curl could re-use NTML authenticateds\n connections\n\n - CVE-2015-3144: curl could access memory out of bounds\n with zero length host names\n\n - CVE-2015-3145: curl cookie parser could access memory\n out of boundary\n\n - CVE-2015-3148: curl could treat Negotiate as not\n connection-oriented", "modified": "2015-11-06T00:00:00", "published": "2015-04-30T00:00:00", "id": "OPENSUSE-2015-336.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=83159", "title": "openSUSE Security Update : curl (openSUSE-2015-336)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2015-336.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(83159);\n script_version(\"$Revision: 2.2 $\");\n script_cvs_date(\"$Date: 2015/11/06 14:51:23 $\");\n\n script_cve_id(\"CVE-2015-3143\", \"CVE-2015-3144\", \"CVE-2015-3145\", \"CVE-2015-3148\");\n\n script_name(english:\"openSUSE Security Update : curl (openSUSE-2015-336)\");\n script_summary(english:\"Check for the openSUSE-2015-336 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"curl was updated to fix four security issues.\n\nThe following vulnerabilities were fixed :\n\n - CVE-2015-3143: curl could re-use NTML authenticateds\n connections\n\n - CVE-2015-3144: curl could access memory out of bounds\n with zero length host names\n\n - CVE-2015-3145: curl cookie parser could access memory\n out of boundary\n\n - CVE-2015-3148: curl could treat Negotiate as not\n connection-oriented\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=927556\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=927607\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=927608\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=927746\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected curl packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:curl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:curl-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcurl-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcurl4\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcurl4-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcurl4-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcurl4-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/04/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/04/30\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.1|SUSE13\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.1 / 13.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.1\", reference:\"curl-7.42.0-2.38.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"curl-debuginfo-7.42.0-2.38.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"curl-debugsource-7.42.0-2.38.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libcurl-devel-7.42.0-2.38.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libcurl4-7.42.0-2.38.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libcurl4-debuginfo-7.42.0-2.38.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libcurl4-32bit-7.42.0-2.38.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libcurl4-debuginfo-32bit-7.42.0-2.38.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"curl-7.42.0-7.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"curl-debuginfo-7.42.0-7.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"curl-debugsource-7.42.0-7.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libcurl-devel-7.42.0-7.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libcurl4-7.42.0-7.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libcurl4-debuginfo-7.42.0-7.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"libcurl4-32bit-7.42.0-7.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"libcurl4-debuginfo-32bit-7.42.0-7.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"curl / curl-debuginfo / curl-debugsource / libcurl-devel / etc\");\n}\n", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-01-16T20:22:07", "bulletinFamily": "scanner", "description": "From Red Hat Security Advisory 2015:1254 :\n\nUpdated curl packages that fix multiple security issues, several bugs,\nand add two enhancements are now available for Red Hat Enterprise\nLinux 6.\n\nRed Hat Product Security has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe curl packages provide the libcurl library and the curl utility for\ndownloading files from servers using various protocols, including\nHTTP, FTP, and LDAP.\n\nIt was found that the libcurl library did not correctly handle partial\nliteral IP addresses when parsing received HTTP cookies. An attacker\nable to trick a user into connecting to a malicious server could use\nthis flaw to set the user's cookie to a crafted domain, making other\ncookie-related issues easier to exploit. (CVE-2014-3613)\n\nA flaw was found in the way the libcurl library performed the\nduplication of connection handles. If an application set the\nCURLOPT_COPYPOSTFIELDS option for a handle, using the handle's\nduplicate could cause the application to crash or disclose a portion\nof its memory. (CVE-2014-3707)\n\nIt was discovered that the libcurl library failed to properly handle\nURLs with embedded end-of-line characters. An attacker able to make an\napplication using libcurl to access a specially crafted URL via an\nHTTP proxy could use this flaw to inject additional headers to the\nrequest or construct additional requests. (CVE-2014-8150)\n\nIt was discovered that libcurl implemented aspects of the NTLM and\nNegotiate authentication incorrectly. If an application uses libcurl\nand the affected mechanisms in a specific way, certain requests to a\npreviously NTLM-authenticated server could appears as sent by the\nwrong authenticated user. Additionally, the initial set of credentials\nfor HTTP Negotiate-authenticated requests could be reused in\nsubsequent requests, although a different set of credentials was\nspecified. (CVE-2015-3143, CVE-2015-3148)\n\nRed Hat would like to thank the cURL project for reporting these\nissues.\n\nBug fixes :\n\n* An out-of-protocol fallback to SSL version 3.0 (SSLv3.0) was\navailable with libcurl. Attackers could abuse the fallback to force\ndowngrade of the SSL version. The fallback has been removed from\nlibcurl. Users requiring this functionality can explicitly enable\nSSLv3.0 through the libcurl API. (BZ#1154059)\n\n* A single upload transfer through the FILE protocol opened the\ndestination file twice. If the inotify kernel subsystem monitored the\nfile, two events were produced unnecessarily. The file is now opened\nonly once per upload. (BZ#883002)\n\n* Utilities using libcurl for SCP/SFTP transfers could terminate\nunexpectedly when the system was running in FIPS mode. (BZ#1008178)\n\n* Using the '--retry' option with the curl utility could cause curl to\nterminate unexpectedly with a segmentation fault. Now, adding\n'--retry' no longer causes curl to crash. (BZ#1009455)\n\n* The 'curl --trace-time' command did not use the correct local time\nwhen printing timestamps. Now, 'curl --trace-time' works as expected.\n(BZ#1120196)\n\n* The valgrind utility could report dynamically allocated memory leaks\non curl exit. Now, curl performs a global shutdown of the NetScape\nPortable Runtime (NSPR) library on exit, and valgrind no longer\nreports the memory leaks. (BZ#1146528)\n\n* Previously, libcurl returned an incorrect value of the\nCURLINFO_HEADER_SIZE field when a proxy server appended its own\nheaders to the HTTP response. Now, the returned value is valid.\n(BZ#1161163)\n\nEnhancements :\n\n* The '--tlsv1.0', '--tlsv1.1', and '--tlsv1.2' options are available\nfor specifying the minor version of the TLS protocol to be negotiated\nby NSS. The '--tlsv1' option now negotiates the highest version of the\nTLS protocol supported by both the client and the server. (BZ#1012136)\n\n* It is now possible to explicitly enable or disable the ECC and the\nnew AES cipher suites to be used for TLS. (BZ#1058767, BZ#1156422)\n\nAll curl users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues and add these\nenhancements.", "modified": "2018-07-18T00:00:00", "published": "2015-07-30T00:00:00", "id": "ORACLELINUX_ELSA-2015-1254.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=85096", "title": "Oracle Linux 6 : curl (ELSA-2015-1254)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2015:1254 and \n# Oracle Linux Security Advisory ELSA-2015-1254 respectively.\n#\n\nif (NASL_LEVEL < 3000) exit(0);\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85096);\n script_version(\"2.5\");\n script_cvs_date(\"Date: 2018/07/18 17:43:58\");\n\n script_cve_id(\"CVE-2014-3613\", \"CVE-2014-3707\", \"CVE-2014-8150\", \"CVE-2015-3143\", \"CVE-2015-3148\");\n script_bugtraq_id(69748, 70988, 71964, 74299, 74301);\n script_xref(name:\"RHSA\", value:\"2015:1254\");\n\n script_name(english:\"Oracle Linux 6 : curl (ELSA-2015-1254)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2015:1254 :\n\nUpdated curl packages that fix multiple security issues, several bugs,\nand add two enhancements are now available for Red Hat Enterprise\nLinux 6.\n\nRed Hat Product Security has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nThe curl packages provide the libcurl library and the curl utility for\ndownloading files from servers using various protocols, including\nHTTP, FTP, and LDAP.\n\nIt was found that the libcurl library did not correctly handle partial\nliteral IP addresses when parsing received HTTP cookies. An attacker\nable to trick a user into connecting to a malicious server could use\nthis flaw to set the user's cookie to a crafted domain, making other\ncookie-related issues easier to exploit. (CVE-2014-3613)\n\nA flaw was found in the way the libcurl library performed the\nduplication of connection handles. If an application set the\nCURLOPT_COPYPOSTFIELDS option for a handle, using the handle's\nduplicate could cause the application to crash or disclose a portion\nof its memory. (CVE-2014-3707)\n\nIt was discovered that the libcurl library failed to properly handle\nURLs with embedded end-of-line characters. An attacker able to make an\napplication using libcurl to access a specially crafted URL via an\nHTTP proxy could use this flaw to inject additional headers to the\nrequest or construct additional requests. (CVE-2014-8150)\n\nIt was discovered that libcurl implemented aspects of the NTLM and\nNegotiate authentication incorrectly. If an application uses libcurl\nand the affected mechanisms in a specific way, certain requests to a\npreviously NTLM-authenticated server could appears as sent by the\nwrong authenticated user. Additionally, the initial set of credentials\nfor HTTP Negotiate-authenticated requests could be reused in\nsubsequent requests, although a different set of credentials was\nspecified. (CVE-2015-3143, CVE-2015-3148)\n\nRed Hat would like to thank the cURL project for reporting these\nissues.\n\nBug fixes :\n\n* An out-of-protocol fallback to SSL version 3.0 (SSLv3.0) was\navailable with libcurl. Attackers could abuse the fallback to force\ndowngrade of the SSL version. The fallback has been removed from\nlibcurl. Users requiring this functionality can explicitly enable\nSSLv3.0 through the libcurl API. (BZ#1154059)\n\n* A single upload transfer through the FILE protocol opened the\ndestination file twice. If the inotify kernel subsystem monitored the\nfile, two events were produced unnecessarily. The file is now opened\nonly once per upload. (BZ#883002)\n\n* Utilities using libcurl for SCP/SFTP transfers could terminate\nunexpectedly when the system was running in FIPS mode. (BZ#1008178)\n\n* Using the '--retry' option with the curl utility could cause curl to\nterminate unexpectedly with a segmentation fault. Now, adding\n'--retry' no longer causes curl to crash. (BZ#1009455)\n\n* The 'curl --trace-time' command did not use the correct local time\nwhen printing timestamps. Now, 'curl --trace-time' works as expected.\n(BZ#1120196)\n\n* The valgrind utility could report dynamically allocated memory leaks\non curl exit. Now, curl performs a global shutdown of the NetScape\nPortable Runtime (NSPR) library on exit, and valgrind no longer\nreports the memory leaks. (BZ#1146528)\n\n* Previously, libcurl returned an incorrect value of the\nCURLINFO_HEADER_SIZE field when a proxy server appended its own\nheaders to the HTTP response. Now, the returned value is valid.\n(BZ#1161163)\n\nEnhancements :\n\n* The '--tlsv1.0', '--tlsv1.1', and '--tlsv1.2' options are available\nfor specifying the minor version of the TLS protocol to be negotiated\nby NSS. The '--tlsv1' option now negotiates the highest version of the\nTLS protocol supported by both the client and the server. (BZ#1012136)\n\n* It is now possible to explicitly enable or disable the ECC and the\nnew AES cipher suites to be used for TLS. (BZ#1058767, BZ#1156422)\n\nAll curl users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues and add these\nenhancements.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2015-July/005229.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected curl packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libcurl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libcurl-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:6\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/07/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/07/30\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !eregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = eregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 6\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL6\", reference:\"curl-7.19.7-46.el6\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"libcurl-7.19.7-46.el6\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"libcurl-devel-7.19.7-46.el6\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"curl / libcurl / libcurl-devel\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "debian": [{"lastseen": "2018-10-16T22:13:29", "bulletinFamily": "unix", "description": "Package : curl\nVersion : 7.21.0-2.1+squeeze12\nCVE ID : CVE-2015-3143 CVE-2015-3148\n\nSeveral vulnerabilities were discovered in cURL, an URL transfer library:\n\nCVE-2015-3143\n\n NTLM-authenticated connections could be wrongly reused for requests\n without any credentials set, leading to HTTP requests being sent\n over the connection authenticated as a different user. This is\n similar to the issue fixed in DSA-2849-1.\n\nCVE-2015-3148\n\n When doing HTTP requests using the Negotiate authentication method\n along with NTLM, the connection used would not be marked as\n authenticated, making it possible to reuse it and send requests for\n one user over the connection authenticated as a different user.\n", "modified": "2015-04-29T20:45:24", "published": "2015-04-29T20:45:24", "id": "DEBIAN:DLA-211-1:EE6A6", "href": "https://lists.debian.org/debian-lts-announce/2015/debian-lts-announce-201504/msg00024.html", "title": "[SECURITY] [DLA 211-1] curl security update", "type": "debian", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-10-18T13:49:34", "bulletinFamily": "unix", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3232-1 security@debian.org\nhttp://www.debian.org/security/ Alessandro Ghedini\nApril 22, 2015 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : curl\nCVE ID : CVE-2015-3143 CVE-2015-3144 CVE-2015-3145 CVE-2015-3148\n\nSeveral vulnerabilities were discovered in cURL, an URL transfer library:\n\nCVE-2015-3143\n\n NTLM-authenticated connections could be wrongly reused for requests\n without any credentials set, leading to HTTP requests being sent\n over the connection authenticated as a different user. This is\n similar to the issue fixed in DSA-2849-1.\n\nCVE-2015-3144\n\n When parsing URLs with a zero-length hostname (such as &quot;http://:80&amp;quot;),\n libcurl would try to read from an invalid memory address. This could\n allow remote attackers to cause a denial of service (crash). This\n issue only affects the upcoming stable (jessie) and unstable (sid)\n distributions.\n\nCVE-2015-3145\n\n When parsing HTTP cookies, if the parsed cookie&#x27;s &quot;path&quot; element\n consists of a single double-quote, libcurl would try to write to an\n invalid heap memory address. This could allow remote attackers to\n cause a denial of service (crash). This issue only affects the\n upcoming stable (jessie) and unstable (sid) distributions.\n\nCVE-2015-3148\n\n When doing HTTP requests using the Negotiate authentication method\n along with NTLM, the connection used would not be marked as\n authenticated, making it possible to reuse it and send requests for\n one user over the connection authenticated as a different user.\n\nFor the stable distribution (wheezy), these problems have been fixed in\nversion 7.26.0-1+wheezy13.\n\nFor the upcoming stable distribution (jessie), these problems have been\nfixed in version 7.38.0-4+deb8u1.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 7.42.0-1.\n\nWe recommend that you upgrade your curl packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "modified": "2015-04-22T12:08:44", "published": "2015-04-22T12:08:44", "id": "DEBIAN:DSA-3232-1:8267A", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2015/msg00120.html", "title": "[SECURITY] [DSA 3232-1] curl security update", "type": "debian", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:58", "bulletinFamily": "software", "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n _______________________________________________________________________\r\n\r\n Mandriva Linux Security Advisory MDVSA-2015:220\r\n http://www.mandriva.com/en/support/security/\r\n _______________________________________________________________________\r\n\r\n Package : curl\r\n Date : May 4, 2015\r\n Affected: Business Server 1.0\r\n _______________________________________________________________________\r\n\r\n Problem Description:\r\n\r\n Updated curl packages fix security vulnerabilities:\r\n \r\n NTLM-authenticated connections could be wrongly reused for requests\r\n without any credentials set, leading to HTTP requests being sent over\r\n the connection authenticated as a different user &#40;CVE-2015-3143&#41;.\r\n \r\n When doing HTTP requests using the Negotiate authentication\r\n method along with NTLM, the connection used would not be marked\r\n as authenticated, making it possible to reuse it and send requests\r\n for one user over the connection authenticated as a different user\r\n &#40;CVE-2015-3148&#41;.\r\n _______________________________________________________________________\r\n\r\n References:\r\n\r\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3143\r\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3148\r\n http://advisories.mageia.org/MGASA-2015-0179.html\r\n _______________________________________________________________________\r\n\r\n Updated Packages:\r\n\r\n Mandriva Business Server 1/X86_64:\r\n fd3f4894f5c5215c29b84d70f2c6ada2 mbs1/x86_64/curl-7.24.0-3.9.mbs1.x86_64.rpm\r\n a00d0747b4d6ae22475948119a42efc4 mbs1/x86_64/curl-examples-7.24.0-3.9.mbs1.x86_64.rpm\r\n d5291ae320dd5766e4b981ff66b36e19 mbs1/x86_64/lib64curl4-7.24.0-3.9.mbs1.x86_64.rpm\r\n 62d5295190433ca4ff7d2cda746d6b16 mbs1/x86_64/lib64curl-devel-7.24.0-3.9.mbs1.x86_64.rpm \r\n 5bcf6538291f947870a9ccfe62c9ea6d mbs1/SRPMS/curl-7.24.0-3.9.mbs1.src.rpm\r\n _______________________________________________________________________\r\n\r\n To upgrade automatically use MandrivaUpdate or urpmi. The verification\r\n of md5 checksums and GPG signatures is performed automatically for you.\r\n\r\n All packages are signed by Mandriva for security. You can obtain the\r\n GPG public key of the Mandriva Security Team by executing:\r\n\r\n gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\r\n\r\n You can view other update advisories for Mandriva Linux at:\r\n\r\n http://www.mandriva.com/en/support/security/advisories/\r\n\r\n If you want to report vulnerabilities, please contact\r\n\r\n security_&#40;at&#41;_mandriva.com\r\n _______________________________________________________________________\r\n\r\n Type Bits/KeyID Date User ID\r\n pub 1024D/22458A98 2000-07-10 Mandriva Security Team\r\n &lt;security*mandriva.com&gt;\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.12 &#40;GNU/Linux&#41;\r\n\r\niD8DBQFVRx8emqjQ0CJFipgRAsfvAJ9Sn2C56m2GSJfYRC+l1x9iUmoePwCeOcgv\r\nC0vndeaT5lGPwsIYy65q4r4=\r\n=GbzX\r\n-----END PGP SIGNATURE-----\r\n\r\n", "modified": "2015-05-04T00:00:00", "published": "2015-05-04T00:00:00", "id": "SECURITYVULNS:DOC:31964", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31964", "title": "[ MDVSA-2015:220 ] curl", "type": "securityvulns", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-08-31T11:10:58", "bulletinFamily": "software", "description": "\r\n\r\n==========================================================================\r\nUbuntu Security Notice USN-2591-1\r\nApril 30, 2015\r\n\r\ncurl vulnerabilities\r\n==========================================================================\r\n\r\nA security issue affects these releases of Ubuntu and its derivatives:\r\n\r\n- Ubuntu 15.04\r\n- Ubuntu 14.10\r\n- Ubuntu 14.04 LTS\r\n- Ubuntu 12.04 LTS\r\n\r\nSummary:\r\n\r\nSeveral security issues were fixed in curl.\r\n\r\nSoftware Description:\r\n- curl: HTTP, HTTPS, and FTP client and client libraries\r\n\r\nDetails:\r\n\r\nParas Sethia discovered that curl could incorrectly re-use NTLM HTTP\r\ncredentials when subsequently connecting to the same host over HTTP.\r\n&#40;CVE-2015-3143&#41;\r\n\r\nHanno Bock discovered that curl incorrectly handled zero-length host names.\r\nIf a user or automated system were tricked into using a specially crafted\r\nhost name, an attacker could possibly use this issue to cause curl to\r\ncrash, resulting in a denial of service, or possibly execute arbitrary\r\ncode. This issue only affected Ubuntu 14.10 and Ubuntu 15.04.\r\n&#40;CVE-2015-3144&#41;\r\n\r\nHanno Bock discovered that curl incorrectly handled cookie path elements.\r\nIf a user or automated system were tricked into parsing a specially crafted\r\ncookie, an attacker could possibly use this issue to cause curl to crash,\r\nresulting in a denial of service, or possibly execute arbitrary code. This\r\nissue only affected Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04.\r\n&#40;CVE-2015-3145&#41;\r\n\r\nIsaac Boukris discovered that when using Negotiate authenticated\r\nconnections, curl could incorrectly authenticate the entire connection and\r\nnot just specific HTTP requests. &#40;CVE-2015-3148&#41;\r\n\r\nYehezkel Horowitz and Oren Souroujon discovered that curl sent HTTP headers\r\nboth to servers and proxies by default, contrary to expectations. This\r\nissue only affected Ubuntu 14.10 and Ubuntu 15.04. &#40;CVE-2015-3153&#41;\r\n\r\nUpdate instructions:\r\n\r\nThe problem can be corrected by updating your system to the following\r\npackage versions:\r\n\r\nUbuntu 15.04:\r\n libcurl3 7.38.0-3ubuntu2.2\r\n libcurl3-gnutls 7.38.0-3ubuntu2.2\r\n libcurl3-nss 7.38.0-3ubuntu2.2\r\n\r\nUbuntu 14.10:\r\n libcurl3 7.37.1-1ubuntu3.4\r\n libcurl3-gnutls 7.37.1-1ubuntu3.4\r\n libcurl3-nss 7.37.1-1ubuntu3.4\r\n\r\nUbuntu 14.04 LTS:\r\n libcurl3 7.35.0-1ubuntu2.5\r\n libcurl3-gnutls 7.35.0-1ubuntu2.5\r\n libcurl3-nss 7.35.0-1ubuntu2.5\r\n\r\nUbuntu 12.04 LTS:\r\n libcurl3 7.22.0-3ubuntu4.14\r\n libcurl3-gnutls 7.22.0-3ubuntu4.14\r\n libcurl3-nss 7.22.0-3ubuntu4.14\r\n\r\nIn general, a standard system update will make all the necessary changes.\r\n\r\nReferences:\r\n http://www.ubuntu.com/usn/usn-2591-1\r\n CVE-2015-3143, CVE-2015-3144, CVE-2015-3145, CVE-2015-3148,\r\n CVE-2015-3153\r\n\r\nPackage Information:\r\n https://launchpad.net/ubuntu/+source/curl/7.38.0-3ubuntu2.2\r\n https://launchpad.net/ubuntu/+source/curl/7.37.1-1ubuntu3.4\r\n https://launchpad.net/ubuntu/+source/curl/7.35.0-1ubuntu2.5\r\n https://launchpad.net/ubuntu/+source/curl/7.22.0-3ubuntu4.14\r\n\r\n\r\n\r\n\r\n-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce\r\n\r\n", "modified": "2015-05-05T00:00:00", "published": "2015-05-05T00:00:00", "id": "SECURITYVULNS:DOC:31976", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31976", "title": "[USN-2591-1] curl vulnerabilities", "type": "securityvulns", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:09:54", "bulletinFamily": "software", "description": "Request may be sent via wrong connection if NTLM authentication is used. Information disclosure, DoS.", "modified": "2015-11-01T00:00:00", "published": "2015-11-01T00:00:00", "id": "SECURITYVULNS:VULN:13544", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13544", "title": "cURL security vulnerabilitiies", "type": "securityvulns", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:10:01", "bulletinFamily": "software", "description": "Over 150 different vulnerabilities in system components and libraries.", "modified": "2015-08-17T00:00:00", "published": "2015-08-17T00:00:00", "id": "SECURITYVULNS:VULN:14630", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:14630", "title": "Apple Mac OS X / OS X Server multiple security vulnerabilities", "type": "securityvulns", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:11:00", "bulletinFamily": "software", "description": "\r\n\r\nAPPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update\r\n2015-006\r\n\r\nOS X Yosemite v10.10.5 and Security Update 2015-006 is now available\r\nand addresses the following:\r\n\r\napache\r\nAvailable for: OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple vulnerabilities existed in Apache 2.4.16, the most\r\nserious of which may allow a remote attacker to cause a denial of\r\nservice.\r\nDescription: Multiple vulnerabilities existed in Apache versions\r\nprior to 2.4.16. These were addressed by updating Apache to version\r\n2.4.16.\r\nCVE-ID\r\nCVE-2014-3581\r\nCVE-2014-3583\r\nCVE-2014-8109\r\nCVE-2015-0228\r\nCVE-2015-0253\r\nCVE-2015-3183\r\nCVE-2015-3185\r\n\r\napache_mod_php\r\nAvailable for: OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple vulnerabilities existed in PHP 5.5.20, the most\r\nserious of which may lead to arbitrary code execution.\r\nDescription: Multiple vulnerabilities existed in PHP versions prior\r\nto 5.5.20. These were addressed by updating Apache to version 5.5.27.\r\nCVE-ID\r\nCVE-2015-2783\r\nCVE-2015-2787\r\nCVE-2015-3307\r\nCVE-2015-3329\r\nCVE-2015-3330\r\nCVE-2015-4021\r\nCVE-2015-4022\r\nCVE-2015-4024\r\nCVE-2015-4025\r\nCVE-2015-4026\r\nCVE-2015-4147\r\nCVE-2015-4148\r\n\r\nApple ID OD Plug-in\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able change the password of a\r\nlocal user\r\nDescription: In some circumstances, a state management issue existed\r\nin password authentication. The issue was addressed through improved\r\nstate management.\r\nCVE-ID\r\nCVE-2015-3799 : an anonymous researcher working with HP&#39;s Zero Day\r\nInitiative\r\n\r\nAppleGraphicsControl\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to determine kernel\r\nmemory layout\r\nDescription: An issue existed in AppleGraphicsControl which could\r\nhave led to the disclosure of kernel memory layout. This issue was\r\naddressed through improved bounds checking.\r\nCVE-ID\r\nCVE-2015-5768 : JieTao Yang of KeenTeam\r\n\r\nBluetooth\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to execute arbitrary code with\r\nsystem privileges\r\nDescription: A memory corruption issue existed in\r\nIOBluetoothHCIController. This issue was addressed through improved\r\nmemory handling.\r\nCVE-ID\r\nCVE-2015-3779 : Teddy Reed of Facebook Security\r\n\r\nBluetooth\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to determine kernel\r\nmemory layout\r\nDescription: A memory management issue could have led to the\r\ndisclosure of kernel memory layout. This issue was addressed with\r\nimproved memory management.\r\nCVE-ID\r\nCVE-2015-3780 : Roberto Paleari and Aristide Fattori of Emaze\r\nNetworks\r\n\r\nBluetooth\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious app may be able to access notifications from\r\nother iCloud devices\r\nDescription: An issue existed where a malicious app could access a\r\nBluetooth-paired Mac or iOS device&#39;s Notification Center\r\nnotifications via the Apple Notification Center Service. The issue\r\naffected devices using Handoff and logged into the same iCloud\r\naccount. This issue was resolved by revoking access to the Apple\r\nNotification Center Service.\r\nCVE-ID\r\nCVE-2015-3786 : Xiaolong Bai &#40;Tsinghua University&#41;, System Security\r\nLab &#40;Indiana University&#41;, Tongxin Li &#40;Peking University&#41;, XiaoFeng\r\nWang &#40;Indiana University&#41;\r\n\r\nBluetooth\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: An attacker with privileged network position may be able to\r\nperform denial of service attack using malformed Bluetooth packets\r\nDescription: An input validation issue existed in parsing of\r\nBluetooth ACL packets. This issue was addressed through improved\r\ninput validation.\r\nCVE-ID\r\nCVE-2015-3787 : Trend Micro\r\n\r\nBluetooth\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local attacker may be able to cause unexpected application\r\ntermination or arbitrary code execution\r\nDescription: Multiple buffer overflow issues existed in blued&#39;s\r\nhandling of XPC messages. These issues were addressed through\r\nimproved bounds checking.\r\nCVE-ID\r\nCVE-2015-3777 : mitp0sh of [PDX]\r\n\r\nbootp\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious Wi-Fi network may be able to determine networks\r\na device has previously accessed\r\nDescription: Upon connecting to a Wi-Fi network, iOS may have\r\nbroadcast MAC addresses of previously accessed networks via the DNAv4\r\nprotocol. This issue was addressed through disabling DNAv4 on\r\nunencrypted Wi-Fi networks.\r\nCVE-ID\r\nCVE-2015-3778 : Piers O&#39;Hanlon of Oxford Internet Institute,\r\nUniversity of Oxford &#40;on the EPSRC Being There project&#41;\r\n\r\nCloudKit\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to access the iCloud\r\nuser record of a previously signed in user\r\nDescription: A state inconsistency existed in CloudKit when signing\r\nout users. This issue was addressed through improved state handling.\r\nCVE-ID\r\nCVE-2015-3782 : Deepkanwal Plaha of University of Toronto\r\n\r\nCoreMedia Playback\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Viewing a maliciously crafted movie file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: Memory corruption issues existed in CoreMedia Playback.\r\nThese were addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-5777 : Apple\r\nCVE-2015-5778 : Apple\r\n\r\nCoreText\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted font file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in the processing of\r\nfont files. This issue was addressed through improved input\r\nvalidation.\r\nCVE-ID\r\nCVE-2015-5761 : John Villamil &#40;@day6reak&#41;, Yahoo Pentest Team\r\n\r\nCoreText\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted font file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in the processing of\r\nfont files. This issue was addressed through improved input\r\nvalidation.\r\nCVE-ID\r\nCVE-2015-5755 : John Villamil &#40;@day6reak&#41;, Yahoo Pentest Team\r\n\r\ncurl\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple vulnerabilities in cURL and libcurl prior to\r\n7.38.0, one of which may allow remote attackers to bypass the Same\r\nOrigin Policy.\r\nDescription: Multiple vulnerabilities existed in cURL and libcurl\r\nprior to 7.38.0. These issues were addressed by updating cURL to\r\nversion 7.43.0.\r\nCVE-ID\r\nCVE-2014-3613\r\nCVE-2014-3620\r\nCVE-2014-3707\r\nCVE-2014-8150\r\nCVE-2014-8151\r\nCVE-2015-3143\r\nCVE-2015-3144\r\nCVE-2015-3145\r\nCVE-2015-3148\r\nCVE-2015-3153\r\n\r\nData Detectors Engine\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a sequence of unicode characters can lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: Memory corruption issues existed in processing of\r\nUnicode characters. These issues were addressed through improved\r\nmemory handling.\r\nCVE-ID\r\nCVE-2015-5750 : M1x7e1 of Safeye Team &#40;www.safeye.org&#41;\r\n\r\nDate &amp; Time pref pane\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Applications that rely on system time may have unexpected\r\nbehavior\r\nDescription: An authorization issue existed when modifying the\r\nsystem date and time preferences. This issue was addressed with\r\nadditional authorization checks.\r\nCVE-ID\r\nCVE-2015-3757 : Mark S C Smith\r\n\r\nDictionary Application\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: An attacker with a privileged network position may be able\r\nto intercept users&#39; Dictionary app queries\r\nDescription: An issue existed in the Dictionary app, which did not\r\nproperly secure user communications. This issue was addressed by\r\nmoving Dictionary queries to HTTPS.\r\nCVE-ID\r\nCVE-2015-3774 : Jeffrey Paul of EEQJ, Jan Bee of the Google Security\r\nTeam\r\n\r\nDiskImages\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted DMG file may lead to an\r\nunexpected application termination or arbitrary code execution with\r\nsystem privileges\r\nDescription: A memory corruption issue existed in parsing of\r\nmalformed DMG images. This issue was addressed through improved\r\nmemory handling.\r\nCVE-ID\r\nCVE-2015-3800 : Frank Graziano of the Yahoo Pentest Team\r\n\r\ndyld\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to execute arbitrary code with\r\nsystem privileges\r\nDescription: A path validation issue existed in dyld. This was\r\naddressed through improved environment sanitization.\r\nCVE-ID\r\nCVE-2015-3760 : beist of grayhash, Stefan Esser\r\n\r\nFontParser\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted font file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in the processing of\r\nfont files. This issue was addressed through improved input\r\nvalidation.\r\nCVE-ID\r\nCVE-2015-3804 : Apple\r\nCVE-2015-5775 : Apple\r\n\r\nFontParser\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted font file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in the processing of\r\nfont files. This issue was addressed through improved input\r\nvalidation.\r\nCVE-ID\r\nCVE-2015-5756 : John Villamil &#40;@day6reak&#41;, Yahoo Pentest Team\r\n\r\ngroff\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple issues in pdfroff\r\nDescription: Multiple issues existed in pdfroff, the most serious of\r\nwhich may allow arbitrary filesystem modification. These issues were\r\naddressed by removing pdfroff.\r\nCVE-ID\r\nCVE-2009-5044\r\nCVE-2009-5078\r\n\r\nImageIO\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted TIFF image may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in the processing of\r\nTIFF images. This issue was addressed through improved bounds\r\nchecking.\r\nCVE-ID\r\nCVE-2015-5758 : Apple\r\n\r\nImageIO\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Visiting a maliciously crafted website may result in the\r\ndisclosure of process memory\r\nDescription: An uninitialized memory access issue existed in\r\nImageIO&#39;s handling of PNG and TIFF images. Visiting a malicious\r\nwebsite may result in sending data from process memory to the\r\nwebsite. This issue is addressed through improved memory\r\ninitialization and additional validation of PNG and TIFF images.\r\nCVE-ID\r\nCVE-2015-5781 : Michal Zalewski\r\nCVE-2015-5782 : Michal Zalewski\r\n\r\nInstall Framework Legacy\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to execute arbitrary\r\ncode with root privileges\r\nDescription: An issue existed in how Install.framework&#39;s &#39;runner&#39;\r\nbinary dropped privileges. This issue was addressed through improved\r\nprivilege management.\r\nCVE-ID\r\nCVE-2015-5784 : Ian Beer of Google Project Zero\r\n\r\nInstall Framework Legacy\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to execute arbitrary\r\ncode with system privileges\r\nDescription: A race condition existed in\r\nInstall.framework&#39;s &#39;runner&#39; binary that resulted in\r\nprivileges being incorrectly dropped. This issue was addressed\r\nthrough improved object locking.\r\nCVE-ID\r\nCVE-2015-5754 : Ian Beer of Google Project Zero\r\n\r\nIOFireWireFamily\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to execute arbitrary code with\r\nsystem privileges\r\nDescription: Memory corruption issues existed in IOFireWireFamily.\r\nThese issues were addressed through additional type input validation.\r\nCVE-ID\r\nCVE-2015-3769 : Ilja van Sprundel\r\nCVE-2015-3771 : Ilja van Sprundel\r\nCVE-2015-3772 : Ilja van Sprundel\r\n\r\nIOGraphics\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to execute arbitrary\r\ncode with system privileges\r\nDescription: A memory corruption issue existed in IOGraphics. This\r\nissue was addressed through additional type input validation.\r\nCVE-ID\r\nCVE-2015-3770 : Ilja van Sprundel\r\nCVE-2015-5783 : Ilja van Sprundel\r\n\r\nIOHIDFamily\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to execute arbitrary code with\r\nsystem privileges\r\nDescription: A buffer overflow issue existed in IOHIDFamily. This\r\nissue was addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-5774 : TaiG Jailbreak Team\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to determine kernel\r\nmemory layout\r\nDescription: An issue existed in the mach_port_space_info interface,\r\nwhich could have led to the disclosure of kernel memory layout. This\r\nwas addressed by disabling the mach_port_space_info interface.\r\nCVE-ID\r\nCVE-2015-3766 : Cererdlong of Alibaba Mobile Security Team,\r\n@PanguTeam\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to execute arbitrary\r\ncode with system privileges\r\nDescription: An integer overflow existed in the handling of IOKit\r\nfunctions. This issue was addressed through improved validation of\r\nIOKit API arguments.\r\nCVE-ID\r\nCVE-2015-3768 : Ilja van Sprundel\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to cause a system denial of service\r\nDescription: A resource exhaustion issue existed in the fasttrap\r\ndriver. This was addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-5747 : Maxime VILLARD of m00nbsd\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to cause a system denial of service\r\nDescription: A validation issue existed in the mounting of HFS\r\nvolumes. This was addressed by adding additional checks.\r\nCVE-ID\r\nCVE-2015-5748 : Maxime VILLARD of m00nbsd\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to execute unsigned code\r\nDescription: An issue existed that allowed unsigned code to be\r\nappended to signed code in a specially crafted executable file. This\r\nissue was addressed through improved code signature validation.\r\nCVE-ID\r\nCVE-2015-3806 : TaiG Jailbreak Team\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A specially crafted executable file could allow unsigned,\r\nmalicious code to execute\r\nDescription: An issue existed in the way multi-architecture\r\nexecutable files were evaluated that could have allowed unsigned code\r\nto be executed. This issue was addressed through improved validation\r\nof executable files.\r\nCVE-ID\r\nCVE-2015-3803 : TaiG Jailbreak Team\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to execute unsigned code\r\nDescription: A validation issue existed in the handling of Mach-O\r\nfiles. This was addressed by adding additional checks.\r\nCVE-ID\r\nCVE-2015-3802 : TaiG Jailbreak Team\r\nCVE-2015-3805 : TaiG Jailbreak Team\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted plist may lead to an\r\nunexpected application termination or arbitrary code execution with\r\nsystem privileges\r\nDescription: A memory corruption existed in processing of malformed\r\nplists. This issue was addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-3776 : Teddy Reed of Facebook Security, Patrick Stein\r\n&#40;@jollyjinx&#41; of Jinx Germany\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to execute arbitrary code with\r\nsystem privileges\r\nDescription: A path validation issue existed. This was addressed\r\nthrough improved environment sanitization.\r\nCVE-ID\r\nCVE-2015-3761 : Apple\r\n\r\nLibc\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted regular expression may lead\r\nto an unexpected application termination or arbitrary code execution\r\nDescription: Memory corruption issues existed in the TRE library.\r\nThese were addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-3796 : Ian Beer of Google Project Zero\r\nCVE-2015-3797 : Ian Beer of Google Project Zero\r\nCVE-2015-3798 : Ian Beer of Google Project Zero\r\n\r\nLibinfo\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: A remote attacker may be able to cause unexpected\r\napplication termination or arbitrary code execution\r\nDescription: Memory corruption issues existed in handling AF_INET6\r\nsockets. These were addressed by improved memory handling.\r\nCVE-ID\r\nCVE-2015-5776 : Apple\r\n\r\nlibpthread\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to execute arbitrary\r\ncode with system privileges\r\nDescription: A memory corruption issue existed in handling syscalls.\r\nThis issue was addressed through improved lock state checking.\r\nCVE-ID\r\nCVE-2015-5757 : Lufeng Li of Qihoo 360\r\n\r\nlibxml2\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple vulnerabilities existed in libxml2 versions prior\r\nto 2.9.2, the most serious of which may allow a remote attacker to\r\ncause a denial of service\r\nDescription: Multiple vulnerabilities existed in libxml2 versions\r\nprior to 2.9.2. These were addressed by updating libxml2 to version\r\n2.9.2.\r\nCVE-ID\r\nCVE-2012-6685 : Felix Groebert of Google\r\nCVE-2014-0191 : Felix Groebert of Google\r\n\r\nlibxml2\r\nAvailable for: OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted XML document may lead to\r\ndisclosure of user information\r\nDescription: A memory access issue existed in libxml2. This was\r\naddressed by improved memory handling\r\nCVE-ID\r\nCVE-2014-3660 : Felix Groebert of Google\r\n\r\nlibxml2\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted XML document may lead to\r\ndisclosure of user information\r\nDescription: A memory corruption issue existed in parsing of XML\r\nfiles. This issue was addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-3807 : Apple\r\n\r\nlibxpc\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to execute arbitrary\r\ncode with system privileges\r\nDescription: A memory corruption issue existed in handling of\r\nmalformed XPC messages. This issue was improved through improved\r\nbounds checking.\r\nCVE-ID\r\nCVE-2015-3795 : Mathew Rowley\r\n\r\nmail_cmds\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to execute arbitrary shell commands\r\nDescription: A validation issue existed in the mailx parsing of\r\nemail addresses. This was addressed by improved sanitization.\r\nCVE-ID\r\nCVE-2014-7844\r\n\r\nNotification Center OSX\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to access all\r\nnotifications previously displayed to users\r\nDescription: An issue existed in Notification Center, which did not\r\nproperly delete user notifications. This issue was addressed by\r\ncorrectly deleting notifications dismissed by users.\r\nCVE-ID\r\nCVE-2015-3764 : Jonathan Zdziarski\r\n\r\nntfs\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to execute arbitrary code with\r\nsystem privileges\r\nDescription: A memory corruption issue existed in NTFS. This issue\r\nwas addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-5763 : Roberto Paleari and Aristide Fattori of Emaze\r\nNetworks\r\n\r\nOpenSSH\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Remote attackers may be able to circumvent a time delay for\r\nfailed login attempts and conduct brute-force attacks\r\nDescription: An issue existed when processing keyboard-interactive\r\ndevices. This issue was addressed through improved authentication\r\nrequest validation.\r\nCVE-ID\r\nCVE-2015-5600\r\n\r\nOpenSSL\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple vulnerabilities existed in OpenSSL versions prior\r\nto 0.9.8zg, the most serious of which may allow a remote attacker to\r\ncause a denial of service.\r\nDescription: Multiple vulnerabilities existed in OpenSSL versions\r\nprior to 0.9.8zg. These were addressed by updating OpenSSL to version\r\n0.9.8zg.\r\nCVE-ID\r\nCVE-2015-1788\r\nCVE-2015-1789\r\nCVE-2015-1790\r\nCVE-2015-1791\r\nCVE-2015-1792\r\n\r\nperl\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted regular expression may lead to\r\ndisclosure of unexpected application termination or arbitrary code\r\nexecution\r\nDescription: An integer underflow issue existed in the way Perl\r\nparsed regular expressions. This issue was addressed through improved\r\nmemory handling.\r\nCVE-ID\r\nCVE-2013-7422\r\n\r\nPostgreSQL\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: An attacker may be able to cause unexpected application\r\ntermination or gain access to data without proper authentication\r\nDescription: Multiple issues existed in PostgreSQL 9.2.4. These\r\nissues were addressed by updating PostgreSQL to 9.2.13.\r\nCVE-ID\r\nCVE-2014-0067\r\nCVE-2014-8161\r\nCVE-2015-0241\r\nCVE-2015-0242\r\nCVE-2015-0243\r\nCVE-2015-0244\r\n\r\npython\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple vulnerabilities existed in Python 2.7.6, the most\r\nserious of which may lead to arbitrary code execution\r\nDescription: Multiple vulnerabilities existed in Python versions\r\nprior to 2.7.6. These were addressed by updating Python to version\r\n2.7.10.\r\nCVE-ID\r\nCVE-2013-7040\r\nCVE-2013-7338\r\nCVE-2014-1912\r\nCVE-2014-7185\r\nCVE-2014-9365\r\n\r\nQL Office\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted Office document may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in parsing of Office\r\ndocuments. This issue was addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-5773 : Apple\r\n\r\nQL Office\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted XML file may lead to\r\ndisclosure of user information\r\nDescription: An external entity reference issue existed in XML file\r\nparsing. This issue was addressed through improved parsing.\r\nCVE-ID\r\nCVE-2015-3784 : Bruno Morisson of INTEGRITY S.A.\r\n\r\nQuartz Composer Framework\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted QuickTime file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in parsing of\r\nQuickTime files. This issue was addressed through improved memory\r\nhandling.\r\nCVE-ID\r\nCVE-2015-5771 : Apple\r\n\r\nQuick Look\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Searching for a previously viewed website may launch the web\r\nbrowser and render that website\r\nDescription: An issue existed where QuickLook had the capability to\r\nexecute JavaScript. The issue was addressed by disallowing execution\r\nof JavaScript.\r\nCVE-ID\r\nCVE-2015-3781 : Andrew Pouliot of Facebook, Anto Loyola of Qubole\r\n\r\nQuickTime 7\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: Multiple memory corruption issues existed in QuickTime.\r\nThese issues were addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-3772\r\nCVE-2015-3779\r\nCVE-2015-5753 : Apple\r\nCVE-2015-5779 : Apple\r\n\r\nQuickTime 7\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: Multiple memory corruption issues existed in QuickTime.\r\nThese issues were addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-3765 : Joe Burnett of Audio Poison\r\nCVE-2015-3788 : Ryan Pentney and Richard Johnson of Cisco Talos\r\nCVE-2015-3789 : Ryan Pentney and Richard Johnson of Cisco Talos\r\nCVE-2015-3790 : Ryan Pentney and Richard Johnson of Cisco Talos\r\nCVE-2015-3791 : Ryan Pentney and Richard Johnson of Cisco Talos\r\nCVE-2015-3792 : Ryan Pentney and Richard Johnson of Cisco Talos\r\nCVE-2015-5751 : WalkerFuz\r\n\r\nSceneKit\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Viewing a maliciously crafted Collada file may lead to\r\narbitrary code execution\r\nDescription: A heap buffer overflow existed in SceneKit&#39;s handling\r\nof Collada files. This issue was addressed through improved input\r\nvalidation.\r\nCVE-ID\r\nCVE-2015-5772 : Apple\r\n\r\nSceneKit\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: A remote attacker may be able to cause unexpected\r\napplication termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in SceneKit. This\r\nissue was addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-3783 : Haris Andrianakis of Google Security Team\r\n\r\nSecurity\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A standard user may be able to gain access to admin\r\nprivileges without proper authentication\r\nDescription: An issue existed in handling of user authentication.\r\nThis issue was addressed through improved authentication checks.\r\nCVE-ID\r\nCVE-2015-3775 : [Eldon Ahrold]\r\n\r\nSMBClient\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A remote attacker may be able to cause unexpected\r\napplication termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in the SMB client.\r\nThis issue was addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-3773 : Ilja van Sprundel\r\n\r\nSpeech UI\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted unicode string with speech\r\nalerts enabled may lead to an unexpected application termination or\r\narbitrary code execution\r\nDescription: A memory corruption issue existed in handling of\r\nUnicode strings. This issue was addressed by improved memory\r\nhandling.\r\nCVE-ID\r\nCVE-2015-3794 : Adam Greenbaum of Refinitive\r\n\r\nsudo\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple vulnerabilities existed in sudo versions prior to\r\n1.7.10p9, the most serious of which may allow an attacker access to\r\narbitrary files\r\nDescription: Multiple vulnerabilities existed in sudo versions prior\r\nto 1.7.10p9. These were addressed by updating sudo to version\r\n1.7.10p9.\r\nCVE-ID\r\nCVE-2013-1775\r\nCVE-2013-1776\r\nCVE-2013-2776\r\nCVE-2013-2777\r\nCVE-2014-0106\r\nCVE-2014-9680\r\n\r\ntcpdump\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple vulnerabilities existed in tcpdump 4.7.3, the most\r\nserious of which may allow a remote attacker to cause a denial of\r\nservice.\r\nDescription: Multiple vulnerabilities existed in tcpdump versions\r\nprior to 4.7.3. These were addressed by updating tcpdump to version\r\n4.7.3.\r\nCVE-ID\r\nCVE-2014-8767\r\nCVE-2014-8769\r\nCVE-2014-9140\r\n\r\nText Formats\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted text file may lead to\r\ndisclosure of user information\r\nDescription: An XML external entity reference issue existed with\r\nTextEdit parsing. This issue was addressed through improved parsing.\r\nCVE-ID\r\nCVE-2015-3762 : Xiaoyong Wu of the Evernote Security Team\r\n\r\nudf\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted DMG file may lead to an\r\nunexpected application termination or arbitrary code execution with\r\nsystem privileges\r\nDescription: A memory corruption issue existed in parsing of\r\nmalformed DMG images. This issue was addressed through improved\r\nmemory handling.\r\nCVE-ID\r\nCVE-2015-3767 : beist of grayhash\r\n\r\nOS X Yosemite v10.10.5 includes the security content of Safari 8.0.8:\r\nhttps://support.apple.com/en-us/HT205033\r\n\r\nOS X Yosemite 10.10.5 and Security Update 2015-006 may be obtained\r\nfrom the Mac App Store or Apple&#39;s Software Downloads web site:\r\nhttp://www.apple.com/support/downloads/\r\n\r\nInformation will also be posted to the Apple Security Updates\r\nweb site: https://support.apple.com/kb/HT201222\r\n\r\nThis message is signed with Apple&#39;s Product Security PGP key,\r\nand details are available at:\r\nhttps://www.apple.com/support/security/pgp/\r\n\r\n\r\n\r\n", "modified": "2015-08-17T00:00:00", "published": "2015-08-17T00:00:00", "id": "SECURITYVULNS:DOC:32390", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32390", "title": "APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update 2015-006", "type": "securityvulns", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "redhat": [{"lastseen": "2018-12-11T17:44:10", "bulletinFamily": "unix", "description": "The curl packages provide the libcurl library and the curl utility for\ndownloading files from servers using various protocols, including HTTP,\nFTP, and LDAP.\n\nIt was found that the libcurl library did not correctly handle partial\nliteral IP addresses when parsing received HTTP cookies. An attacker able\nto trick a user into connecting to a malicious server could use this flaw\nto set the user's cookie to a crafted domain, making other cookie-related\nissues easier to exploit. (CVE-2014-3613)\n\nA flaw was found in the way the libcurl library performed the duplication\nof connection handles. If an application set the CURLOPT_COPYPOSTFIELDS\noption for a handle, using the handle's duplicate could cause the\napplication to crash or disclose a portion of its memory. (CVE-2014-3707)\n\nIt was discovered that the libcurl library failed to properly handle URLs\nwith embedded end-of-line characters. An attacker able to make an\napplication using libcurl access a specially crafted URL via an HTTP proxy\ncould use this flaw to inject additional headers to the request or\nconstruct additional requests. (CVE-2014-8150)\n\nIt was discovered that libcurl implemented aspects of the NTLM and\nNegotatiate authentication incorrectly. If an application uses libcurl\nand the affected mechanisms in a specifc way, certain requests to a\npreviously NTLM-authenticated server could appears as sent by the wrong\nauthenticated user. Additionally, the initial set of credentials for HTTP\nNegotiate-authenticated requests could be reused in subsequent requests,\nalthough a different set of credentials was specified. (CVE-2015-3143,\nCVE-2015-3148)\n\nRed Hat would like to thank the cURL project for reporting these issues.\n\nBug fixes:\n\n* An out-of-protocol fallback to SSL 3.0 was available with libcurl.\nAttackers could abuse the fallback to force downgrade of the SSL version.\nThe fallback has been removed from libcurl. Users requiring this\nfunctionality can explicitly enable SSL 3.0 through the libcurl API.\n(BZ#1154060)\n\n* TLS 1.1 and TLS 1.2 are no longer disabled by default in libcurl. You can\nexplicitly disable them through the libcurl API. (BZ#1170339)\n\n* FTP operations such as downloading files took a significantly long time\nto complete. Now, the FTP implementation in libcurl correctly sets blocking\ndirection and estimated timeout for connections, resulting in faster FTP\ntransfers. (BZ#1218272)\n\nEnhancements:\n\n* With the updated packages, it is possible to explicitly enable or disable\nnew Advanced Encryption Standard (AES) cipher suites to be used for the TLS\nprotocol. (BZ#1066065)\n\n* The libcurl library did not implement a non-blocking SSL handshake, which\nnegatively affected performance of applications based on the libcurl multi\nAPI. The non-blocking SSL handshake has been implemented in libcurl, and\nthe libcurl multi API now immediately returns the control back to the\napplication whenever it cannot read or write data from or to the underlying\nnetwork socket. (BZ#1091429)\n\n* The libcurl library used an unnecessarily long blocking delay for actions\nwith no active file descriptors, even for short operations. Some actions,\nsuch as resolving a host name using /etc/hosts, took a long time to\ncomplete. The blocking code in libcurl has been modified so that the\ninitial delay is short and gradually increases until an event occurs.\n(BZ#1130239)\n\nAll curl users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues and add these\nenhancements.", "modified": "2018-04-12T03:32:37", "published": "2015-11-19T19:41:12", "id": "RHSA-2015:2159", "href": "https://access.redhat.com/errata/RHSA-2015:2159", "type": "redhat", "title": "(RHSA-2015:2159) Moderate: curl security, bug fix, and enhancement update", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-12-11T19:40:52", "bulletinFamily": "unix", "description": "The curl packages provide the libcurl library and the curl utility for\ndownloading files from servers using various protocols, including HTTP,\nFTP, and LDAP.\n\nIt was found that the libcurl library did not correctly handle partial\nliteral IP addresses when parsing received HTTP cookies. An attacker able\nto trick a user into connecting to a malicious server could use this flaw\nto set the user's cookie to a crafted domain, making other cookie-related\nissues easier to exploit. (CVE-2014-3613)\n\nA flaw was found in the way the libcurl library performed the duplication\nof connection handles. If an application set the CURLOPT_COPYPOSTFIELDS\noption for a handle, using the handle's duplicate could cause the\napplication to crash or disclose a portion of its memory. (CVE-2014-3707)\n\nIt was discovered that the libcurl library failed to properly handle URLs\nwith embedded end-of-line characters. An attacker able to make an\napplication using libcurl to access a specially crafted URL via an HTTP\nproxy could use this flaw to inject additional headers to the request or\nconstruct additional requests. (CVE-2014-8150)\n\nIt was discovered that libcurl implemented aspects of the NTLM and\nNegotatiate authentication incorrectly. If an application uses libcurl\nand the affected mechanisms in a specifc way, certain requests to a\npreviously NTLM-authenticated server could appears as sent by the wrong\nauthenticated user. Additionally, the initial set of credentials for HTTP\nNegotiate-authenticated requests could be reused in subsequent requests,\nalthough a different set of credentials was specified. (CVE-2015-3143,\nCVE-2015-3148)\n\nRed Hat would like to thank the cURL project for reporting these issues.\n\nBug fixes:\n\n* An out-of-protocol fallback to SSL version 3.0 (SSLv3.0) was available\nwith libcurl. Attackers could abuse the fallback to force downgrade of the\nSSL version. The fallback has been removed from libcurl. Users requiring\nthis functionality can explicitly enable SSLv3.0 through the libcurl API.\n(BZ#1154059)\n\n* A single upload transfer through the FILE protocol opened the destination\nfile twice. If the inotify kernel subsystem monitored the file, two events\nwere produced unnecessarily. The file is now opened only once per upload.\n(BZ#883002)\n\n* Utilities using libcurl for SCP/SFTP transfers could terminate\nunexpectedly when the system was running in FIPS mode. (BZ#1008178)\n\n* Using the \"--retry\" option with the curl utility could cause curl to\nterminate unexpectedly with a segmentation fault. Now, adding \"--retry\" no\nlonger causes curl to crash. (BZ#1009455)\n\n* The \"curl --trace-time\" command did not use the correct local time when\nprinting timestamps. Now, \"curl --trace-time\" works as expected.\n(BZ#1120196)\n\n* The valgrind utility could report dynamically allocated memory leaks on\ncurl exit. Now, curl performs a global shutdown of the NetScape Portable\nRuntime (NSPR) library on exit, and valgrind no longer reports the memory\nleaks. (BZ#1146528)\n\n* Previously, libcurl returned an incorrect value of the\nCURLINFO_HEADER_SIZE field when a proxy server appended its own headers to\nthe HTTP response. Now, the returned value is valid. (BZ#1161163)\n\nEnhancements:\n\n* The \"--tlsv1.0\", \"--tlsv1.1\", and \"--tlsv1.2\" options are available for\nspecifying the minor version of the TLS protocol to be negotiated by NSS.\nThe \"--tlsv1\" option now negotiates the highest version of the TLS protocol\nsupported by both the client and the server. (BZ#1012136)\n\n* It is now possible to explicitly enable or disable the ECC and the new\nAES cipher suites to be used for TLS. (BZ#1058767, BZ#1156422)\n\nAll curl users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues and add these\nenhancements.\n", "modified": "2018-06-06T20:24:28", "published": "2015-07-22T09:29:46", "id": "RHSA-2015:1254", "href": "https://access.redhat.com/errata/RHSA-2015:1254", "type": "redhat", "title": "(RHSA-2015:1254) Moderate: curl security, bug fix, and enhancement update", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "kaspersky": [{"lastseen": "2019-02-15T12:35:09", "bulletinFamily": "info", "description": "### *Detect date*:\n04/24/2015\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple serious vulnerabilities have been found in cURL. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service or conduct other unknown impact.\n\n### *Affected products*:\ncURL and libcurl versions from 7.10.6 through 7.41.0\n\n### *Solution*:\nUpdate ti the latest version \n[Get cURL](<http://curl.haxx.se/download.html>)\n\n### *Original advisories*:\n[cURL advisory](<http://curl.haxx.se/docs/adv_20150422C.html>) \n[cURL advisory](<http://curl.haxx.se/docs/adv_20150422B.html>) \n[cURL advisory](<http://curl.haxx.se/docs/adv_20150422D.html>) \n[cURL advisory](<http://curl.haxx.se/docs/adv_20150422A.html>) \n\n\n### *Impacts*:\nDoS \n\n### *Related products*:\n[cURL](<https://threats.kaspersky.com/en/product/cURL/>)\n\n### *CVE-IDS*:\n[CVE-2015-3148](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3148>) \n[CVE-2015-3145](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3145>) \n[CVE-2015-3143](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3143>) \n[CVE-2015-3144](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3144>)", "modified": "2019-02-13T00:00:00", "published": "2015-04-24T00:00:00", "id": "KLA10566", "href": "https://threats.kaspersky.com/en/vulnerability/KLA10566", "title": "\r KLA10566Multiple vulnerabilities in cURL ", "type": "kaspersky", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "openvas": [{"lastseen": "2018-09-28T18:24:48", "bulletinFamily": "scanner", "description": "Oracle Linux Local Security Checks ELSA-2015-1254", "modified": "2018-09-28T00:00:00", "published": "2015-10-06T00:00:00", "id": "OPENVAS:1361412562310123056", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310123056", "title": "Oracle Linux Local Check: ELSA-2015-1254", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: ELSA-2015-1254.nasl 11688 2018-09-28 13:36:28Z cfischer $\n#\n# Oracle Linux Local Check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.123056\");\n script_version(\"$Revision: 11688 $\");\n script_tag(name:\"creation_date\", value:\"2015-10-06 13:58:47 +0300 (Tue, 06 Oct 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-28 15:36:28 +0200 (Fri, 28 Sep 2018) $\");\n script_name(\"Oracle Linux Local Check: ELSA-2015-1254\");\n script_tag(name:\"insight\", value:\"ELSA-2015-1254 - curl security, bug fix, and enhancement update. Please see the references for more insight.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"summary\", value:\"Oracle Linux Local Security Checks ELSA-2015-1254\");\n script_xref(name:\"URL\", value:\"http://linux.oracle.com/errata/ELSA-2015-1254.html\");\n script_cve_id(\"CVE-2014-3613\", \"CVE-2014-3707\", \"CVE-2014-8150\", \"CVE-2015-3143\", \"CVE-2015-3148\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/oracle_linux\", \"ssh/login/release\", re:\"ssh/login/release=OracleLinux6\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Eero Volotinen\");\n script_family(\"Oracle Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"OracleLinux6\")\n{\n if ((res = isrpmvuln(pkg:\"curl\", rpm:\"curl~7.19.7~46.el6\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"libcurl\", rpm:\"libcurl~7.19.7~46.el6\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"libcurl-devel\", rpm:\"libcurl-devel~7.19.7~46.el6\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n}\nif (__pkg_match) exit(99);\n exit(0);\n\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-11-19T13:01:05", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2018-11-16T00:00:00", "published": "2015-05-01T00:00:00", "id": "OPENVAS:1361412562310842186", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310842186", "title": "Ubuntu Update for curl USN-2591-1", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Ubuntu Update for curl USN-2591-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.842186\");\n script_version(\"$Revision: 12381 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-16 12:16:30 +0100 (Fri, 16 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2015-05-01 05:50:17 +0200 (Fri, 01 May 2015)\");\n script_cve_id(\"CVE-2015-3143\", \"CVE-2015-3144\", \"CVE-2015-3145\", \"CVE-2015-3148\",\n \"CVE-2015-3153\");\n script_tag(name:\"cvss_base\", value:\"9.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for curl USN-2591-1\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'curl'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"Paras Sethia discovered that curl could\nincorrectly re-use NTLM HTTP credentials when subsequently connecting to the\nsame host over HTTP. (CVE-2015-3143)\n\nHanno B&#246 ck discovered that curl incorrectly handled zero-length host names.\nIf a user or automated system were tricked into using a specially crafted\nhost name, an attacker could possibly use this issue to cause curl to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 14.10 and Ubuntu 15.04.\n(CVE-2015-3144)\n\nHanno B&#246 ck discovered that curl incorrectly handled cookie path elements.\nIf a user or automated system were tricked into parsing a specially crafted\ncookie, an attacker could possibly use this issue to cause curl to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04.\n(CVE-2015-3145)\n\nIsaac Boukris discovered that when using Negotiate authenticated\nconnections, curl could incorrectly authenticate the entire connection and\nnot just specific HTTP requests. (CVE-2015-3148)\n\nYehezkel Horowitz and Oren Souroujon discovered that curl sent HTTP headers\nboth to servers and proxies by default, contrary to expectations. This\nissue only affected Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-3153)\");\n script_tag(name:\"affected\", value:\"curl on Ubuntu 14.10,\n Ubuntu 14.04 LTS,\n Ubuntu 12.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_xref(name:\"USN\", value:\"2591-1\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-2591-1/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU(14\\.10|14\\.04 LTS|12\\.04 LTS)\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"UBUNTU14.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libcurl3:amd64\", ver:\"7.37.1-1ubuntu3.4\", rls:\"UBUNTU14.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3:i386\", ver:\"7.37.1-1ubuntu3.4\", rls:\"UBUNTU14.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-gnutls:amd64\", ver:\"7.37.1-1ubuntu3.4\", rls:\"UBUNTU14.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-gnutls:i386\", ver:\"7.37.1-1ubuntu3.4\", rls:\"UBUNTU14.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-nss:amd64\", ver:\"7.37.1-1ubuntu3.4\", rls:\"UBUNTU14.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-nss:i386\", ver:\"7.37.1-1ubuntu3.4\", rls:\"UBUNTU14.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU14.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libcurl3:i386\", ver:\"7.35.0-1ubuntu2.5\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3:amd64\", ver:\"7.35.0-1ubuntu2.5\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-gnutls:i386\", ver:\"7.35.0-1ubuntu2.5\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-gnutls:amd64\", ver:\"7.35.0-1ubuntu2.5\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-nss:amd64\", ver:\"7.35.0-1ubuntu2.5\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-nss:i386\", ver:\"7.35.0-1ubuntu2.5\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU12.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libcurl3\", ver:\"7.22.0-3ubuntu4.14\", rls:\"UBUNTU12.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-gnutls\", ver:\"7.22.0-3ubuntu4.14\", rls:\"UBUNTU12.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-nss\", ver:\"7.22.0-3ubuntu4.14\", rls:\"UBUNTU12.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-01T23:51:12", "bulletinFamily": "scanner", "description": "Check the version of mingw-curl", "modified": "2017-07-10T00:00:00", "published": "2015-07-07T00:00:00", "id": "OPENVAS:1361412562310869729", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869729", "title": "Fedora Update for mingw-curl FEDORA-2015-6864", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for mingw-curl FEDORA-2015-6864\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869729\");\n script_version(\"$Revision: 6630 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:34:32 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2015-07-07 06:40:35 +0200 (Tue, 07 Jul 2015)\");\n script_cve_id(\"CVE-2014-8150\", \"CVE-2015-3143\", \"CVE-2015-3148\", \"CVE-2015-3145\",\n \"CVE-2015-3144\");\n script_tag(name:\"cvss_base\", value:\"9.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for mingw-curl FEDORA-2015-6864\");\n script_tag(name: \"summary\", value: \"Check the version of mingw-curl\");\n script_tag(name: \"vuldetect\", value: \"Get the installed version with the help\nof detect NVT and check if the version is vulnerable or not.\");\n script_tag(name: \"insight\", value: \"cURL is a tool for getting files from HTTP,\nFTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the\nsupported protocols. cURL is designed to work without user interaction or any\nkind of interactivity. cURL offers many useful capabilities, like proxy support,\nuser authentication, FTP upload, HTTP post, and file transfer resume.\n\nThis is the MinGW cross-compiled Windows library.\n\");\n script_tag(name: \"affected\", value: \"mingw-curl on Fedora 22\");\n script_tag(name: \"solution\", value: \"Please Install the Updated Packages.\");\n script_xref(name: \"FEDORA\", value: \"2015-6864\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC22\")\n{\n\n if ((res = isrpmvuln(pkg:\"mingw-curl\", rpm:\"mingw-curl~7.42.0~1.fc22\", rls:\"FC22\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-11-23T15:13:14", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2018-11-23T00:00:00", "published": "2015-07-23T00:00:00", "id": "OPENVAS:1361412562310871401", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310871401", "title": "RedHat Update for curl RHSA-2015:1254-02", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for curl RHSA-2015:1254-02\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.871401\");\n script_version(\"$Revision: 12497 $\");\n script_cve_id(\"CVE-2014-3613\", \"CVE-2014-3707\", \"CVE-2014-8150\",\n \"CVE-2015-3143\", \"CVE-2015-3148\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-23 09:28:21 +0100 (Fri, 23 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2015-07-23 06:25:30 +0200 (Thu, 23 Jul 2015)\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"RedHat Update for curl RHSA-2015:1254-02\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'curl'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"The curl packages provide the libcurl library and the curl utility for\ndownloading files from servers using various protocols, including HTTP,\nFTP, and LDAP.\n\nIt was found that the libcurl library did not correctly handle partial\nliteral IP addresses when parsing received HTTP cookies. An attacker able\nto trick a user into connecting to a malicious server could use this flaw\nto set the user's cookie to a crafted domain, making other cookie-related\nissues easier to exploit. (CVE-2014-3613)\n\nA flaw was found in the way the libcurl library performed the duplication\nof connection handles. If an application set the CURLOPT_COPYPOSTFIELDS\noption for a handle, using the handle's duplicate could cause the\napplication to crash or disclose a portion of its memory. (CVE-2014-3707)\n\nIt was discovered that the libcurl library failed to properly handle URLs\nwith embedded end-of-line characters. An attacker able to make an\napplication using libcurl to access a specially crafted URL via an HTTP\nproxy could use this flaw to inject additional headers to the request or\nconstruct additional requests. (CVE-2014-8150)\n\nIt was discovered that libcurl implemented aspects of the NTLM and\nNegotatiate authentication incorrectly. If an application uses libcurl\nand the affected mechanisms in a specific way, certain requests to a\npreviously NTLM-authenticated server could appears as sent by the wrong\nauthenticated user. Additionally, the initial set of credentials for HTTP\nNegotiate-authenticated requests could be reused in subsequent requests,\nalthough a different set of credentials was specified. (CVE-2015-3143,\nCVE-2015-3148)\n\nRed Hat would like to thank the cURL project for reporting these issues.\n\nBug fixes:\n\n * An out-of-protocol fallback to SSL version 3.0 (SSLv3.0) was available\nwith libcurl. Attackers could abuse the fallback to force downgrade of the\nSSL version. The fallback has been removed from libcurl. Users requiring\nthis functionality can explicitly enable SSLv3.0 through the libcurl API.\n(BZ#1154059)\n\n * A single upload transfer through the FILE protocol opened the destination\nfile twice. If the inotify kernel subsystem monitored the file, two events\nwere produced unnecessarily. The file is now opened only once per upload.\n(BZ#883002)\n\n * Utilities using libcurl for SCP/SFTP transfers could terminate\nunexpectedly when the system was running in FIPS mode. (BZ#1008178)\n\n * Using the '--retry' option with the curl utility could cause curl to\nterminate unexpectedly with a segmentation fault. Now, adding ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"affected\", value:\"curl on Red Hat Enterprise Linux Desktop (v. 6),\n Red Hat Enterprise Linux Server (v. 6),\n Red Hat Enterprise Linux Workstation (v. 6)\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_xref(name:\"RHSA\", value:\"2015:1254-02\");\n script_xref(name:\"URL\", value:\"https://www.redhat.com/archives/rhsa-announce/2015-July/msg00019.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\", re:\"ssh/login/release=RHENT_6\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"RHENT_6\")\n{\n\n if ((res = isrpmvuln(pkg:\"curl\", rpm:\"curl~7.19.7~46.el6\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"curl-debuginfo\", rpm:\"curl-debuginfo~7.19.7~46.el6\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libcurl\", rpm:\"libcurl~7.19.7~46.el6\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libcurl-devel\", rpm:\"libcurl-devel~7.19.7~46.el6\", rls:\"RHENT_6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-09-01T23:49:20", "bulletinFamily": "scanner", "description": "Check the version of curl", "modified": "2017-07-10T00:00:00", "published": "2015-05-03T00:00:00", "id": "OPENVAS:1361412562310869334", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869334", "title": "Fedora Update for curl FEDORA-2015-6728", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for curl FEDORA-2015-6728\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869334\");\n script_version(\"$Revision: 6630 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:34:32 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2015-05-03 05:41:14 +0200 (Sun, 03 May 2015)\");\n script_cve_id(\"CVE-2015-3143\", \"CVE-2015-3144\", \"CVE-2015-3145\", \"CVE-2015-3148\",\n \"CVE-2014-8150\");\n script_tag(name:\"cvss_base\", value:\"9.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for curl FEDORA-2015-6728\");\n script_tag(name: \"summary\", value: \"Check the version of curl\");\n script_tag(name: \"vuldetect\", value: \"Get the installed version with the help\nof detect NVT and check if the version is vulnerable or not.\");\n script_tag(name: \"insight\", value: \"curl is a command line tool for\ntransferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP,\nTFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports\nSSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload,\nproxies, cookies, user+password authentication\n(Basic, Digest, NTLM, Negotiate, kerberos...), file transfer resume, proxy\ntunneling and a busload of other useful tricks.\n\");\n script_tag(name: \"affected\", value: \"curl on Fedora 21\");\n script_tag(name: \"solution\", value: \"Please Install the Updated Packages.\");\n script_xref(name: \"FEDORA\", value: \"2015-6728\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC21\")\n{\n\n if ((res = isrpmvuln(pkg:\"curl\", rpm:\"curl~7.37.0~14.fc21\", rls:\"FC21\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:54:01", "bulletinFamily": "scanner", "description": "Several vulnerabilities were\ndiscovered in cURL, an URL transfer library:\n\nCVE-2015-3143 \nNTLM-authenticated connections could be wrongly reused for requests\nwithout any credentials set, leading to HTTP requests being sent\nover the connection authenticated as a different user. This is\nsimilar to the issue fixed in DSA-2849-1.\n\nCVE-2015-3144 \nWhen parsing URLs with a zero-length hostname (such as ", "modified": "2017-07-07T00:00:00", "published": "2015-04-22T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=703232", "id": "OPENVAS:703232", "title": "Debian Security Advisory DSA 3232-1 (curl - security update)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3232.nasl 6609 2017-07-07 12:05:59Z cfischer $\n# Auto-generated from advisory DSA 3232-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\n\nif(description)\n{\n script_id(703232);\n script_version(\"$Revision: 6609 $\");\n script_cve_id(\"CVE-2015-3143\", \"CVE-2015-3144\", \"CVE-2015-3145\", \"CVE-2015-3148\");\n script_name(\"Debian Security Advisory DSA 3232-1 (curl - security update)\");\n script_tag(name: \"last_modification\", value: \"$Date: 2017-07-07 14:05:59 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value: \"2015-04-22 00:00:00 +0200 (Wed, 22 Apr 2015)\");\n script_tag(name:\"cvss_base\", value:\"9.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n script_tag(name: \"qod_type\", value: \"package\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2015/dsa-3232.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: \"curl on Debian Linux\");\n script_tag(name: \"insight\", value: \"curl is a command line tool for\ntransferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER,\nHTTP, HTTPS, IMAP, IMAPS, LDAP, POP3, POP3S, RTMP, RTSP, SCP, SFTP, SMTP, SMTPS,\nTELNET and TFTP.\");\n script_tag(name: \"solution\", value: \"For the stable distribution (wheezy),\nthese problems have been fixed in version 7.26.0-1+wheezy13.\n\nFor the upcoming stable distribution (jessie), these problems have been\nfixed in version 7.38.0-4+deb8u1.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 7.42.0-1.\n\nWe recommend that you upgrade your curl packages.\");\n script_tag(name: \"summary\", value: \"Several vulnerabilities were\ndiscovered in cURL, an URL transfer library:\n\nCVE-2015-3143 \nNTLM-authenticated connections could be wrongly reused for requests\nwithout any credentials set, leading to HTTP requests being sent\nover the connection authenticated as a different user. This is\nsimilar to the issue fixed in DSA-2849-1.\n\nCVE-2015-3144 \nWhen parsing URLs with a zero-length hostname (such as 'http://:80'),\nlibcurl would try to read from an invalid memory address. This could\nallow remote attackers to cause a denial of service (crash). This\nissue only affects the upcoming stable (jessie) and unstable (sid)\ndistributions.\n\nCVE-2015-3145When parsing HTTP cookies, if the parsed cookie's path \nelement\nconsists of a single double-quote, libcurl would try to write to an\ninvalid heap memory address. This could allow remote attackers to\ncause a denial of service (crash). This issue only affects the\nupcoming stable (jessie) and unstable (sid) distributions.\n\nCVE-2015-3148 \nWhen doing HTTP requests using the Negotiate authentication method\nalong with NTLM, the connection used would not be marked as\nauthenticated, making it possible to reuse it and send requests for\none user over the connection authenticated as a different user.\");\n script_tag(name: \"vuldetect\", value: \"This check tests the installed\nsoftware version using the apt package manager.\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"curl\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl3:amd64\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl3:i386\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl3-dbg:amd64\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl3-dbg:i386\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl3-gnutls:amd64\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl3-gnutls:i386\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl3-nss:amd64\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl3-nss:i386\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl4-gnutls-dev\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl4-nss-dev\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl4-openssl-dev\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-01T23:51:32", "bulletinFamily": "scanner", "description": "Check the version of curl", "modified": "2017-07-10T00:00:00", "published": "2015-07-07T00:00:00", "id": "OPENVAS:1361412562310869500", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869500", "title": "Fedora Update for curl FEDORA-2015-6695", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for curl FEDORA-2015-6695\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869500\");\n script_version(\"$Revision: 6630 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:34:32 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2015-07-07 06:20:32 +0200 (Tue, 07 Jul 2015)\");\n script_cve_id(\"CVE-2015-3143\", \"CVE-2015-3144\", \"CVE-2015-3145\", \"CVE-2015-3148\");\n script_tag(name:\"cvss_base\", value:\"9.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for curl FEDORA-2015-6695\");\n script_tag(name: \"summary\", value: \"Check the version of curl\");\n script_tag(name: \"vuldetect\", value: \"Get the installed version with the help\nof detect NVT and check if the version is vulnerable or not.\");\n script_tag(name: \"insight\", value: \"curl is a command line tool for\ntransferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP,\nTFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports\nSSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload,\nproxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate,\nkerberos...), file transfer resume, proxy tunneling and a busload of other useful\ntricks.\n\");\n script_tag(name: \"affected\", value: \"curl on Fedora 22\");\n script_tag(name: \"solution\", value: \"Please Install the Updated Packages.\");\n script_xref(name: \"FEDORA\", value: \"2015-6695\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC22\")\n{\n\n if ((res = isrpmvuln(pkg:\"curl\", rpm:\"curl~7.40.0~3.fc22\", rls:\"FC22\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-28T18:25:50", "bulletinFamily": "scanner", "description": "Oracle Linux Local Security Checks ELSA-2015-2159", "modified": "2018-09-28T00:00:00", "published": "2015-11-24T00:00:00", "id": "OPENVAS:1361412562310122761", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310122761", "title": "Oracle Linux Local Check: ELSA-2015-2159", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: ELSA-2015-2159.nasl 11688 2018-09-28 13:36:28Z cfischer $\n#\n# Oracle Linux Local Check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.122761\");\n script_version(\"$Revision: 11688 $\");\n script_tag(name:\"creation_date\", value:\"2015-11-24 10:17:33 +0200 (Tue, 24 Nov 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-28 15:36:28 +0200 (Fri, 28 Sep 2018) $\");\n script_name(\"Oracle Linux Local Check: ELSA-2015-2159\");\n script_tag(name:\"insight\", value:\"ELSA-2015-2159 - curl security, bug fix, and enhancement update. Please see the references for more insight.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"summary\", value:\"Oracle Linux Local Security Checks ELSA-2015-2159\");\n script_xref(name:\"URL\", value:\"http://linux.oracle.com/errata/ELSA-2015-2159.html\");\n script_cve_id(\"CVE-2014-3613\", \"CVE-2014-3707\", \"CVE-2014-8150\", \"CVE-2015-3143\", \"CVE-2015-3148\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/oracle_linux\", \"ssh/login/release\", re:\"ssh/login/release=OracleLinux7\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Eero Volotinen\");\n script_family(\"Oracle Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"OracleLinux7\")\n{\n if ((res = isrpmvuln(pkg:\"curl\", rpm:\"curl~7.29.0~25.0.1.el7\", rls:\"OracleLinux7\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"libcurl\", rpm:\"libcurl~7.29.0~25.0.1.el7\", rls:\"OracleLinux7\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"libcurl-devel\", rpm:\"libcurl-devel~7.29.0~25.0.1.el7\", rls:\"OracleLinux7\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n}\nif (__pkg_match) exit(99);\n exit(0);\n\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-11-23T15:11:51", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2018-11-23T00:00:00", "published": "2015-11-20T00:00:00", "id": "OPENVAS:1361412562310871491", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310871491", "title": "RedHat Update for curl RHSA-2015:2159-06", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for curl RHSA-2015:2159-06\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.871491\");\n script_version(\"$Revision: 12497 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-23 09:28:21 +0100 (Fri, 23 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2015-11-20 06:21:32 +0100 (Fri, 20 Nov 2015)\");\n script_cve_id(\"CVE-2014-3613\", \"CVE-2014-3707\", \"CVE-2014-8150\", \"CVE-2015-3143\",\n \"CVE-2015-3148\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"RedHat Update for curl RHSA-2015:2159-06\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'curl'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"The curl packages provide the libcurl\nlibrary and the curl utility for downloading files from servers using various\nprotocols, including HTTP, FTP, and LDAP.\n\nIt was found that the libcurl library did not correctly handle partial\nliteral IP addresses when parsing received HTTP cookies. An attacker able\nto trick a user into connecting to a malicious server could use this flaw\nto set the user's cookie to a crafted domain, making other cookie-related\nissues easier to exploit. (CVE-2014-3613)\n\nA flaw was found in the way the libcurl library performed the duplication\nof connection handles. If an application set the CURLOPT_COPYPOSTFIELDS\noption for a handle, using the handle's duplicate could cause the\napplication to crash or disclose a portion of its memory. (CVE-2014-3707)\n\nIt was discovered that the libcurl library failed to properly handle URLs\nwith embedded end-of-line characters. An attacker able to make an\napplication using libcurl access a specially crafted URL via an HTTP proxy\ncould use this flaw to inject additional headers to the request or\nconstruct additional requests. (CVE-2014-8150)\n\nIt was discovered that libcurl implemented aspects of the NTLM and\nNegotatiate authentication incorrectly. If an application uses libcurl\nand the affected mechanisms in a specific way, certain requests to a\npreviously NTLM-authenticated server could appears as sent by the wrong\nauthenticated user. Additionally, the initial set of credentials for HTTP\nNegotiate-authenticated requests could be reused in subsequent requests,\nalthough a different set of credentials was specified. (CVE-2015-3143,\nCVE-2015-3148)\n\nRed Hat would like to thank the cURL project for reporting these issues.\n\nBug fixes:\n\n * An out-of-protocol fallback to SSL 3.0 was available with libcurl.\nAttackers could abuse the fallback to force downgrade of the SSL version.\nThe fallback has been removed from libcurl. Users requiring this\nfunctionality can explicitly enable SSL 3.0 through the libcurl API.\n(BZ#1154060)\n\n * TLS 1.1 and TLS 1.2 are no longer disabled by default in libcurl. You can\nexplicitly disable them through the libcurl API. (BZ#1170339)\n\n * FTP operations such as downloading files took a significantly long time\nto complete. Now, the FTP implementation in libcurl correctly sets blocking\ndirection and estimated timeout for connections, resulting in faster FTP\ntransfers. (BZ#1218272)\n\nEnhancements:\n\n * With the updated packages, it is possible to explicitly enable or disable\nnew Advanced Encryption Standard (AES) cipher suites to be used for the TLS\nprotocol. (BZ#1066065)\n\n * The libcurl library did not impleme ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"affected\", value:\"curl on Red Hat Enterprise Linux Server (v. 7)\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_xref(name:\"RHSA\", value:\"2015:2159-06\");\n script_xref(name:\"URL\", value:\"https://www.redhat.com/archives/rhsa-announce/2015-November/msg00028.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\", re:\"ssh/login/release=RHENT_7\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"RHENT_7\")\n{\n\n if ((res = isrpmvuln(pkg:\"curl\", rpm:\"curl~7.29.0~25.el7\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"curl-debuginfo\", rpm:\"curl-debuginfo~7.29.0~25.el7\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libcurl\", rpm:\"libcurl~7.29.0~25.el7\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libcurl-devel\", rpm:\"libcurl-devel~7.29.0~25.el7\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-09-01T23:52:35", "bulletinFamily": "scanner", "description": "Several vulnerabilities were\ndiscovered in cURL, an URL transfer library:\n\nCVE-2015-3143 \nNTLM-authenticated connections could be wrongly reused for requests\nwithout any credentials set, leading to HTTP requests being sent\nover the connection authenticated as a different user. This is\nsimilar to the issue fixed in DSA-2849-1.\n\nCVE-2015-3144 \nWhen parsing URLs with a zero-length hostname (such as ", "modified": "2018-04-06T00:00:00", "published": "2015-04-22T00:00:00", "id": "OPENVAS:1361412562310703232", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310703232", "title": "Debian Security Advisory DSA 3232-1 (curl - security update)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3232.nasl 9355 2018-04-06 07:16:07Z cfischer $\n# Auto-generated from advisory DSA 3232-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.703232\");\n script_version(\"$Revision: 9355 $\");\n script_cve_id(\"CVE-2015-3143\", \"CVE-2015-3144\", \"CVE-2015-3145\", \"CVE-2015-3148\");\n script_name(\"Debian Security Advisory DSA 3232-1 (curl - security update)\");\n script_tag(name: \"last_modification\", value: \"$Date: 2018-04-06 09:16:07 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name: \"creation_date\", value: \"2015-04-22 00:00:00 +0200 (Wed, 22 Apr 2015)\");\n script_tag(name:\"cvss_base\", value:\"9.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n script_tag(name: \"qod_type\", value: \"package\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2015/dsa-3232.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: \"curl on Debian Linux\");\n script_tag(name: \"insight\", value: \"curl is a command line tool for\ntransferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER,\nHTTP, HTTPS, IMAP, IMAPS, LDAP, POP3, POP3S, RTMP, RTSP, SCP, SFTP, SMTP, SMTPS,\nTELNET and TFTP.\");\n script_tag(name: \"solution\", value: \"For the stable distribution (wheezy),\nthese problems have been fixed in version 7.26.0-1+wheezy13.\n\nFor the upcoming stable distribution (jessie), these problems have been\nfixed in version 7.38.0-4+deb8u1.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 7.42.0-1.\n\nWe recommend that you upgrade your curl packages.\");\n script_tag(name: \"summary\", value: \"Several vulnerabilities were\ndiscovered in cURL, an URL transfer library:\n\nCVE-2015-3143 \nNTLM-authenticated connections could be wrongly reused for requests\nwithout any credentials set, leading to HTTP requests being sent\nover the connection authenticated as a different user. This is\nsimilar to the issue fixed in DSA-2849-1.\n\nCVE-2015-3144 \nWhen parsing URLs with a zero-length hostname (such as 'http://:80'),\nlibcurl would try to read from an invalid memory address. This could\nallow remote attackers to cause a denial of service (crash). This\nissue only affects the upcoming stable (jessie) and unstable (sid)\ndistributions.\n\nCVE-2015-3145When parsing HTTP cookies, if the parsed cookie's path \nelement\nconsists of a single double-quote, libcurl would try to write to an\ninvalid heap memory address. This could allow remote attackers to\ncause a denial of service (crash). This issue only affects the\nupcoming stable (jessie) and unstable (sid) distributions.\n\nCVE-2015-3148 \nWhen doing HTTP requests using the Negotiate authentication method\nalong with NTLM, the connection used would not be marked as\nauthenticated, making it possible to reuse it and send requests for\none user over the connection authenticated as a different user.\");\n script_tag(name: \"vuldetect\", value: \"This check tests the installed\nsoftware version using the apt package manager.\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"curl\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl3:amd64\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl3:i386\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl3-dbg:amd64\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl3-dbg:i386\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl3-gnutls:amd64\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl3-gnutls:i386\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl3-nss:amd64\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl3-nss:i386\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl4-gnutls-dev\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl4-nss-dev\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libcurl4-openssl-dev\", ver:\"7.26.0-1+wheezy13\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "oraclelinux": [{"lastseen": "2018-08-31T01:42:01", "bulletinFamily": "unix", "description": "[7.29.0-25.0.1]\n- disable check to make build pass\n[7.29.0-25]\n- fix spurious failure of test 1500 on ppc64le (#1218272)\n[7.29.0-24]\n- use the default min/max TLS version provided by NSS (#1170339)\n- improve handling of timeouts and blocking direction to speed up FTP (#1218272)\n[7.29.0-23]\n- require credentials to match for NTLM re-use (CVE-2015-3143)\n- close Negotiate connections when done (CVE-2015-3148)\n[7.29.0-22]\n- reject CRLFs in URLs passed to proxy (CVE-2014-8150)\n[7.29.0-21]\n- use only full matches for hosts used as IP address in cookies (CVE-2014-3613)\n- fix handling of CURLOPT_COPYPOSTFIELDS in curl_easy_duphandle (CVE-2014-3707)\n[7.29.0-20]\n- eliminate unnecessary delay when resolving host from /etc/hosts (#1130239)\n- allow to enable/disable new AES cipher-suites (#1066065)\n- call PR_Cleanup() on curl tool exit if NSPR is used (#1071254)\n- implement non-blocking TLS handshake (#1091429)\n- fix limited connection re-use for unencrypted HTTP (#1101092)\n- disable libcurl-level downgrade to SSLv3 (#1154060)\n- include response headers added by proxy in CURLINFO_HEADER_SIZE (#1161182)\n- ignore CURLOPT_FORBID_REUSE during NTLM HTTP auth (#1166264)", "modified": "2015-11-23T00:00:00", "published": "2015-11-23T00:00:00", "id": "ELSA-2015-2159", "href": "http://linux.oracle.com/errata/ELSA-2015-2159.html", "title": "curl security, bug fix, and enhancement update", "type": "oraclelinux", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-08-31T01:39:57", "bulletinFamily": "unix", "description": "[7.19.7-46]\n- require credentials to match for NTLM re-use (CVE-2015-3143)\n- close Negotiate connections when done (CVE-2015-3148)\n[7.19.7-45]\n- reject CRLFs in URLs passed to proxy (CVE-2014-8150)\n[7.19.7-44]\n- use only full matches for hosts used as IP address in cookies (CVE-2014-3613)\n- fix handling of CURLOPT_COPYPOSTFIELDS in curl_easy_duphandle (CVE-2014-3707)\n[7.19.7-43]\n- fix manpage typos found using aspell (#1011101)\n- fix comments about loading CA certs with NSS in man pages (#1011083)\n- fix handling of DNS cache timeout while a transfer is in progress (#835898)\n- eliminate unnecessary inotify events on upload via file protocol (#883002)\n- use correct socket type in the examples (#997185)\n- do not crash if MD5 fingerprint is not provided by libssh2 (#1008178)\n- fix SIGSEGV of curl --retry when network is down (#1009455)\n- allow to use TLS 1.1 and TLS 1.2 (#1012136)\n- docs: update the links to cipher-suites supported by NSS (#1104160)\n- allow to use ECC ciphers if NSS implements them (#1058767)\n- make curl --trace-time print correct time (#1120196)\n- let tool call PR_Cleanup() on exit if NSPR is used (#1146528)\n- ignore CURLOPT_FORBID_REUSE during NTLM HTTP auth (#1154747)\n- allow to enable/disable new AES cipher-suites (#1156422)\n- include response headers added by proxy in CURLINFO_HEADER_SIZE (#1161163)\n- disable libcurl-level downgrade to SSLv3 (#1154059)\n[7.19.7-42]\n- do not force connection close after failed HEAD request (#1168137)\n- fix occasional SIGSEGV during SSL handshake (#1168668)\n[7.19.7-41]\n- fix a connection failure when FTPS handle is reused (#1154663)", "modified": "2015-07-28T00:00:00", "published": "2015-07-28T00:00:00", "id": "ELSA-2015-1254", "href": "http://linux.oracle.com/errata/ELSA-2015-1254.html", "title": "curl security, bug fix, and enhancement update", "type": "oraclelinux", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "centos": [{"lastseen": "2017-10-03T18:26:56", "bulletinFamily": "unix", "description": "**CentOS Errata and Security Advisory** CESA-2015:1254\n\n\nThe curl packages provide the libcurl library and the curl utility for\ndownloading files from servers using various protocols, including HTTP,\nFTP, and LDAP.\n\nIt was found that the libcurl library did not correctly handle partial\nliteral IP addresses when parsing received HTTP cookies. An attacker able\nto trick a user into connecting to a malicious server could use this flaw\nto set the user's cookie to a crafted domain, making other cookie-related\nissues easier to exploit. (CVE-2014-3613)\n\nA flaw was found in the way the libcurl library performed the duplication\nof connection handles. If an application set the CURLOPT_COPYPOSTFIELDS\noption for a handle, using the handle's duplicate could cause the\napplication to crash or disclose a portion of its memory. (CVE-2014-3707)\n\nIt was discovered that the libcurl library failed to properly handle URLs\nwith embedded end-of-line characters. An attacker able to make an\napplication using libcurl to access a specially crafted URL via an HTTP\nproxy could use this flaw to inject additional headers to the request or\nconstruct additional requests. (CVE-2014-8150)\n\nIt was discovered that libcurl implemented aspects of the NTLM and\nNegotatiate authentication incorrectly. If an application uses libcurl\nand the affected mechanisms in a specifc way, certain requests to a\npreviously NTLM-authenticated server could appears as sent by the wrong\nauthenticated user. Additionally, the initial set of credentials for HTTP\nNegotiate-authenticated requests could be reused in subsequent requests,\nalthough a different set of credentials was specified. (CVE-2015-3143,\nCVE-2015-3148)\n\nRed Hat would like to thank the cURL project for reporting these issues.\n\nBug fixes:\n\n* An out-of-protocol fallback to SSL version 3.0 (SSLv3.0) was available\nwith libcurl. Attackers could abuse the fallback to force downgrade of the\nSSL version. The fallback has been removed from libcurl. Users requiring\nthis functionality can explicitly enable SSLv3.0 through the libcurl API.\n(BZ#1154059)\n\n* A single upload transfer through the FILE protocol opened the destination\nfile twice. If the inotify kernel subsystem monitored the file, two events\nwere produced unnecessarily. The file is now opened only once per upload.\n(BZ#883002)\n\n* Utilities using libcurl for SCP/SFTP transfers could terminate\nunexpectedly when the system was running in FIPS mode. (BZ#1008178)\n\n* Using the \"--retry\" option with the curl utility could cause curl to\nterminate unexpectedly with a segmentation fault. Now, adding \"--retry\" no\nlonger causes curl to crash. (BZ#1009455)\n\n* The \"curl --trace-time\" command did not use the correct local time when\nprinting timestamps. Now, \"curl --trace-time\" works as expected.\n(BZ#1120196)\n\n* The valgrind utility could report dynamically allocated memory leaks on\ncurl exit. Now, curl performs a global shutdown of the NetScape Portable\nRuntime (NSPR) library on exit, and valgrind no longer reports the memory\nleaks. (BZ#1146528)\n\n* Previously, libcurl returned an incorrect value of the\nCURLINFO_HEADER_SIZE field when a proxy server appended its own headers to\nthe HTTP response. Now, the returned value is valid. (BZ#1161163)\n\nEnhancements:\n\n* The \"--tlsv1.0\", \"--tlsv1.1\", and \"--tlsv1.2\" options are available for\nspecifying the minor version of the TLS protocol to be negotiated by NSS.\nThe \"--tlsv1\" option now negotiates the highest version of the TLS protocol\nsupported by both the client and the server. (BZ#1012136)\n\n* It is now possible to explicitly enable or disable the ECC and the new\nAES cipher suites to be used for TLS. (BZ#1058767, BZ#1156422)\n\nAll curl users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues and add these\nenhancements.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-cr-announce/2015-July/002018.html\n\n**Affected packages:**\ncurl\nlibcurl\nlibcurl-devel\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2015-1254.html", "modified": "2015-07-26T14:12:23", "published": "2015-07-26T14:12:23", "href": "http://lists.centos.org/pipermail/centos-cr-announce/2015-July/002018.html", "id": "CESA-2015:1254", "title": "curl, libcurl security update", "type": "centos", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-10-03T18:25:02", "bulletinFamily": "unix", "description": "**CentOS Errata and Security Advisory** CESA-2015:2159\n\n\nThe curl packages provide the libcurl library and the curl utility for\ndownloading files from servers using various protocols, including HTTP,\nFTP, and LDAP.\n\nIt was found that the libcurl library did not correctly handle partial\nliteral IP addresses when parsing received HTTP cookies. An attacker able\nto trick a user into connecting to a malicious server could use this flaw\nto set the user's cookie to a crafted domain, making other cookie-related\nissues easier to exploit. (CVE-2014-3613)\n\nA flaw was found in the way the libcurl library performed the duplication\nof connection handles. If an application set the CURLOPT_COPYPOSTFIELDS\noption for a handle, using the handle's duplicate could cause the\napplication to crash or disclose a portion of its memory. (CVE-2014-3707)\n\nIt was discovered that the libcurl library failed to properly handle URLs\nwith embedded end-of-line characters. An attacker able to make an\napplication using libcurl access a specially crafted URL via an HTTP proxy\ncould use this flaw to inject additional headers to the request or\nconstruct additional requests. (CVE-2014-8150)\n\nIt was discovered that libcurl implemented aspects of the NTLM and\nNegotatiate authentication incorrectly. If an application uses libcurl\nand the affected mechanisms in a specifc way, certain requests to a\npreviously NTLM-authenticated server could appears as sent by the wrong\nauthenticated user. Additionally, the initial set of credentials for HTTP\nNegotiate-authenticated requests could be reused in subsequent requests,\nalthough a different set of credentials was specified. (CVE-2015-3143,\nCVE-2015-3148)\n\nRed Hat would like to thank the cURL project for reporting these issues.\n\nBug fixes:\n\n* An out-of-protocol fallback to SSL 3.0 was available with libcurl.\nAttackers could abuse the fallback to force downgrade of the SSL version.\nThe fallback has been removed from libcurl. Users requiring this\nfunctionality can explicitly enable SSL 3.0 through the libcurl API.\n(BZ#1154060)\n\n* TLS 1.1 and TLS 1.2 are no longer disabled by default in libcurl. You can\nexplicitly disable them through the libcurl API. (BZ#1170339)\n\n* FTP operations such as downloading files took a significantly long time\nto complete. Now, the FTP implementation in libcurl correctly sets blocking\ndirection and estimated timeout for connections, resulting in faster FTP\ntransfers. (BZ#1218272)\n\nEnhancements:\n\n* With the updated packages, it is possible to explicitly enable or disable\nnew Advanced Encryption Standard (AES) cipher suites to be used for the TLS\nprotocol. (BZ#1066065)\n\n* The libcurl library did not implement a non-blocking SSL handshake, which\nnegatively affected performance of applications based on the libcurl multi\nAPI. The non-blocking SSL handshake has been implemented in libcurl, and\nthe libcurl multi API now immediately returns the control back to the\napplication whenever it cannot read or write data from or to the underlying\nnetwork socket. (BZ#1091429)\n\n* The libcurl library used an unnecessarily long blocking delay for actions\nwith no active file descriptors, even for short operations. Some actions,\nsuch as resolving a host name using /etc/hosts, took a long time to\ncomplete. The blocking code in libcurl has been modified so that the\ninitial delay is short and gradually increases until an event occurs.\n(BZ#1130239)\n\nAll curl users are advised to upgrade to these updated packages, which\ncontain backported patches to correct these issues and add these\nenhancements.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-cr-announce/2015-November/002182.html\n\n**Affected packages:**\ncurl\nlibcurl\nlibcurl-devel\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2015-2159.html", "modified": "2015-11-30T19:26:37", "published": "2015-11-30T19:26:37", "href": "http://lists.centos.org/pipermail/centos-cr-announce/2015-November/002182.html", "id": "CESA-2015:2159", "title": "curl, libcurl security update", "type": "centos", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "archlinux": [{"lastseen": "2016-09-02T18:44:46", "bulletinFamily": "unix", "description": "- CVE-2015-3143 (re-using authenticated connection when unauthenticated):\n\nlibcurl keeps a pool of its last few connections around after use to\nfascilitate easy, conventient and completely transparent connection\nre-use for applications. When doing HTTP requests NTLM authenticated,\nthe entire connnection becomes authenticated and not just the specific\nHTTP request which is otherwise how HTTP works. This makes NTLM special\nand a subject for special treatment in the code. With NTLM, once the\nconnection is authenticated, no further authentication is necessary\nuntil the connection gets closed. libcurl's connection re-use logic will\nselect an existing connection for re-use when asked to do a request, and\nwhen asked to use NTLM libcurl have to pick a connection with matching\ncredentials only. If a connection was first setup and used for an NTLM\nHTTP request with a specific set of credentials, that same connection\ncould later wrongly get re-used in a subsequent HTTP request that was\nmade to the same host - but without having any credentials set! Since an\nNTLM connection was already authenticated due to how NTLM works, the\nsubsequent request could then get sent over the wrong connection\nappearing as the initial user. This problem is very similar to the\nprevious problem known as CVE-2014-0015. The main difference this time\nis that the subsequent request that wrongly re-use a connection doesn't\nask for NTLM authentication.\n\n- CVE-2015-3144 (host name out of boundary memory access):\n\nThere is a private function in libcurl called fix_hostname() that\nremoves a trailing dot from the host name if there is one. The function\nis called after the host name has been extracted from the URL libcurl\nhas been told to act on. If a URL is given with a zero-length host name,\nlike in &quot;<A HREF=\"http://:80\">http://:80</A>&quot; or just &quot;:80&quot;, fix_hostname() will index the host\nname pointer with a -1 offset (as it blindly assumes a non-zero length)\nand both read and assign that address. At best, this gets unnoticed but\ncan also lead to a crash or worse. We have not researched further what\nkind of malicious actions that potentially this could be used for.\n\n- CVE-2015-3145 (cookie parser out of boundary memory access):\n\nlibcurl supports HTTP &quot;cookies&quot; as documented in RFC 6265. Together with\neach individual cookie there are several different properties, but for\nthis vulnerability we focus on the associated &quot;path&quot; element. It tells\ninformation about for which path on a given host the cookies is valid.\nThe internal libcurl function called sanitize_cookie_path() that cleans\nup the path element as given to it from a remote site or when read from\na file, did not properly validate the input. If given a path that\nconsisted of a single double-quote, libcurl would index a newly\nallocated memory area with index -1 and assign a zero to it, thus\ndestroying heap memory it wasn't supposed to. At best, this gets\nunnoticed but can also lead to a crash or worse. We have not researched\nfurther what kind of malicious actions that potentially this could be\nused for. Applications have to explicitly enable cookie parsing in\nlibcurl for this problem to trigger, and if not enabled libcurl will not\nhit this problem.\n\n- CVE-2015-3148 (negotiate not treated as connection-oriented):\n\nlibcurl keeps a pool of its last few connections around after use to\nfascilitate easy, conventient and completely transparent connection\nre-use for applications. When doing HTTP requests Negotiate\nauthenticated, the entire connnection may become authenticated and not\njust the specific HTTP request which is otherwise how HTTP works, as\nNegotiate can basically use NTLM under the hood. curl was not adhering\nto this fact but would assume that such requests would also be\nauthenticated per request. The net effect is that libcurl may end up\nre-using an authenticated Negotiate connection and sending subsequent\nrequests on it using new credentials, while the connection remains\nauthenticated with a previous initial credentials setup.", "modified": "2015-04-24T00:00:00", "published": "2015-04-24T00:00:00", "href": "https://lists.archlinux.org/pipermail/arch-security/2015-April/000309.html", "id": "ASA-201504-28", "title": "curl: multiple issues", "type": "archlinux", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "ubuntu": [{"lastseen": "2018-08-31T00:08:56", "bulletinFamily": "unix", "description": "Paras Sethia discovered that curl could incorrectly re-use NTLM HTTP credentials when subsequently connecting to the same host over HTTP. (CVE-2015-3143)\n\nHanno B\u00f6ck discovered that curl incorrectly handled zero-length host names. If a user or automated system were tricked into using a specially crafted host name, an attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-3144)\n\nHanno B\u00f6ck discovered that curl incorrectly handled cookie path elements. If a user or automated system were tricked into parsing a specially crafted cookie, an attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-3145)\n\nIsaac Boukris discovered that when using Negotiate authenticated connections, curl could incorrectly authenticate the entire connection and not just specific HTTP requests. (CVE-2015-3148)\n\nYehezkel Horowitz and Oren Souroujon discovered that curl sent HTTP headers both to servers and proxies by default, contrary to expectations. This issue only affected Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-3153)", "modified": "2015-04-30T00:00:00", "published": "2015-04-30T00:00:00", "id": "USN-2591-1", "href": "https://usn.ubuntu.com/2591-1/", "title": "curl vulnerabilities", "type": "ubuntu", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "amazon": [{"lastseen": "2018-10-02T16:55:14", "bulletinFamily": "unix", "description": "**Issue Overview:**\n\nIt was discovered that libcurl could incorrectly reuse NTLM-authenticated connections for subsequent unauthenticated requests to the same host. If an application using libcurl established an NTLM-authenticated connection to a server, and sent subsequent unauthenticed requests to the same server, the unauthenticated requests could be sent over the NTLM-authenticated connection, appearing as if they were sent by the NTLM authenticated user. ([CVE-2015-3143 __](<https://access.redhat.com/security/cve/CVE-2015-3143>))\n\nIt was discovered that libcurl could incorrectly reuse Negotiate authenticated HTTP connections for subsequent requests. If an application using libcurl established a Negotiate authenticated HTTP connection to a server and sent subsequent requests with different credentials, the connection could be re-used with the initial set of credentials instead of using the new ones. ([CVE-2015-3148 __](<https://access.redhat.com/security/cve/CVE-2015-3148>))\n\nIt was discovered that libcurl did not properly process cookies with a specially crafted \"path\" element. If an application using libcurl connected to a malicious HTTP server sending specially crafted \"Set-Cookies\" headers, this could lead to an out-of-bounds read, and possibly cause that application to crash. ([CVE-2015-3145 __](<https://access.redhat.com/security/cve/CVE-2015-3145>))\n\nIt was discovered that libcurl did not properly process zero-length host names. If an attacker could trick an application using libcurl into processing zero-length host names, this could lead to an out-of-bounds read, and possibly cause that application to crash. ([CVE-2015-3144 __](<https://access.redhat.com/security/cve/CVE-2015-3144>))\n\n \n**Affected Packages:** \n\n\ncurl\n\n \n**Issue Correction:** \nRun _yum update curl_ to update your system.\n\n \n\n\n**New Packages:**\n \n \n i686: \n curl-7.40.0-3.50.amzn1.i686 \n curl-debuginfo-7.40.0-3.50.amzn1.i686 \n libcurl-devel-7.40.0-3.50.amzn1.i686 \n libcurl-7.40.0-3.50.amzn1.i686 \n \n src: \n curl-7.40.0-3.50.amzn1.src \n \n x86_64: \n curl-7.40.0-3.50.amzn1.x86_64 \n libcurl-7.40.0-3.50.amzn1.x86_64 \n curl-debuginfo-7.40.0-3.50.amzn1.x86_64 \n libcurl-devel-7.40.0-3.50.amzn1.x86_64 \n \n \n", "modified": "2015-04-23T21:05:00", "published": "2015-04-23T21:05:00", "id": "ALAS-2015-514", "href": "https://alas.aws.amazon.com/ALAS-2015-514.html", "title": "Medium: curl", "type": "amazon", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "slackware": [{"lastseen": "2018-08-31T02:36:47", "bulletinFamily": "unix", "description": "New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,\nand -current to fix security issues.\n\n\nHere are the details from the Slackware 14.1 ChangeLog:\n\npatches/packages/curl-7.45.0-i486-1_slack14.1.txz: Upgraded.\n Fixes some security issues.\n For more information, see:\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3143\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3144\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3145\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3148\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3236\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3237\n (* Security fix *)\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the &quot;Get Slack&quot; section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated package for Slackware 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/curl-7.45.0-i486-1_slack13.0.txz\n\nUpdated package for Slackware x86_64 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/curl-7.45.0-x86_64-1_slack13.0.txz\n\nUpdated package for Slackware 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/curl-7.45.0-i486-1_slack13.1.txz\n\nUpdated package for Slackware x86_64 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/curl-7.45.0-x86_64-1_slack13.1.txz\n\nUpdated package for Slackware 13.37:\nftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/curl-7.45.0-i486-1_slack13.37.txz\n\nUpdated package for Slackware x86_64 13.37:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/curl-7.45.0-x86_64-1_slack13.37.txz\n\nUpdated package for Slackware 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/curl-7.45.0-i486-1_slack14.0.txz\n\nUpdated package for Slackware x86_64 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/curl-7.45.0-x86_64-1_slack14.0.txz\n\nUpdated package for Slackware 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/curl-7.45.0-i486-1_slack14.1.txz\n\nUpdated package for Slackware x86_64 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/curl-7.45.0-x86_64-1_slack14.1.txz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/curl-7.45.0-i586-1.txz\n\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/curl-7.45.0-x86_64-1.txz\n\n\nMD5 signatures:\n\nSlackware 13.0 package:\ne9307566f43c3c12ac72f12cea688741 curl-7.45.0-i486-1_slack13.0.txz\n\nSlackware x86_64 13.0 package:\n5fe5a7733ce969f8f468c6b03cf6b1f7 curl-7.45.0-x86_64-1_slack13.0.txz\n\nSlackware 13.1 package:\n9d3d5ccbae7284c84c4667885bf9fd0d curl-7.45.0-i486-1_slack13.1.txz\n\nSlackware x86_64 13.1 package:\n7e7f04d3de8d34b8b082729ceaa53ba9 curl-7.45.0-x86_64-1_slack13.1.txz\n\nSlackware 13.37 package:\n00bd418a8607ea74d1986c08d5358052 curl-7.45.0-i486-1_slack13.37.txz\n\nSlackware x86_64 13.37 package:\n23e7da7ab6846fed5d18b5f5399ac400 curl-7.45.0-x86_64-1_slack13.37.txz\n\nSlackware 14.0 package:\n76f010b92c755f16f19840723d845e21 curl-7.45.0-i486-1_slack14.0.txz\n\nSlackware x86_64 14.0 package:\ndaf0b67147a50e44d89f8852632fcdf7 curl-7.45.0-x86_64-1_slack14.0.txz\n\nSlackware 14.1 package:\n8c2a5796d4a4ce840a767423667eb97b curl-7.45.0-i486-1_slack14.1.txz\n\nSlackware x86_64 14.1 package:\n763157115101b63867217707ff4a9021 curl-7.45.0-x86_64-1_slack14.1.txz\n\nSlackware -current package:\n0c2d192aff4af6f74281a1d724d31ce3 n/curl-7.45.0-i586-1.txz\n\nSlackware x86_64 -current package:\n4791e2bb2afd43ec0642d94e22259e81 n/curl-7.45.0-x86_64-1.txz\n\n\nInstallation instructions:\n\nUpgrade the package as root:\n > upgradepkg curl-7.45.0-i486-1_slack14.1.txz", "modified": "2015-10-29T15:48:27", "published": "2015-10-29T15:48:27", "id": "SSA-2015-302-01", "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.513154", "title": "curl", "type": "slackware", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:02", "bulletinFamily": "unix", "description": "### Background\n\ncURL is a tool and libcurl is a library for transferring data with URL syntax. \n\n### Description\n\nMultiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker could possibly obtain sensitive information, or cause a Denial of Service condition. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll cURL users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-misc/curl-7.43.0\"", "modified": "2015-09-24T00:00:00", "published": "2015-09-24T00:00:00", "id": "GLSA-201509-02", "href": "https://security.gentoo.org/glsa/201509-02", "type": "gentoo", "title": "cURL: Multiple vulnerabilities", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}