curl: curl still vulnerable to SMB access smuggling via FILE URL on Windows

🗓️ 08 Mar 2020 01:06:41Reported by tsedlmeyerType

hackerone

hackerone🔗 hackerone.com👁 28 Views

curl still vulnerable to SMB access smuggling via FILE URL on Windows. Fix for CVE-2019-15601 not effective

Reporter	Title	Published	Views	Family All 37
FreeBSD	MySQL Server -- Multiple vulerabilities	14 Apr 202000:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM MQ is affected by a vulnerability within cURL libcurl (CVE-2019-15601)	15 Apr 202010:24	–	ibm
IBM Security Bulletins	Security Bulletin: cURL vulnerability CVE-2019-15601 impacts IBM Aspera High-Speed Transfer Server 3.9.6.2 and earlier and Aspera High-Speed Transfer Endpoint 3.9.6.2 and earlier	10 Dec 202023:59	–	ibm
IBM Security Bulletins	Security Bulletin: cURL vulnerability CVE-2019-15601 impacts IBM Aspera Streaming/IBM Aspera Streaming for Video version 3.9.6.1 and earlier	8 Dec 202018:37	–	ibm
Cloud Foundry	PXC Release update for April 2020 MySQL security patches \| Cloud Foundry	10 Aug 202000:00	–	cloudfoundry
CNVD	Haxx curl input validation error vulnerability	8 Jan 202000:00	–	cnvd
CVE	CVE-2019-15601	6 Jan 202016:32	–	cve
Cvelist	CVE-2019-15601	6 Jan 202016:32	–	cvelist
Tenable Nessus	EulerOS 2.0 SP8 : curl (EulerOS-SA-2020-1144)	25 Feb 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.6.0 : curl (EulerOS-SA-2020-1345)	2 Apr 202000:00	–	nessus

08 Jan 2021 14:16Current

2.2Low risk

Vulners AI Score2.2

curl vulnerability smb access smuggling file url windows cve-2019-15601 bugbounty