ID DEBIAN_DSA-3992.NASL Type nessus Reporter This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof. Modified 2017-10-09T00:00:00
Description
Several vulnerabilities have been discovered in cURL, an URL transfer
library. The Common Vulnerabilities and Exposures project identifies
the following problems :
CVE-2017-1000100
Even Rouault reported that cURL does not properly handle
long file names when doing an TFTP upload. A malicious
HTTP(S) server can take advantage of this flaw by
redirecting a client using the cURL library to a crafted
TFTP URL and trick it to send private memory contents to
a remote server over UDP.
CVE-2017-1000101
Brian Carpenter and Yongji Ouyang reported that cURL
contains a flaw in the globbing function that parses the
numerical range, leading to an out-of-bounds read when
parsing a specially crafted URL.
CVE-2017-1000254
Max Dymond reported that cURL contains an out-of-bounds
read flaw in the FTP PWD response parser. A malicious
server can take advantage of this flaw to effectively
prevent a client using the cURL library to work with it,
causing a denial of service.
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory DSA-3992. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(103715);
script_version("3.6");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/04");
script_cve_id("CVE-2017-1000100", "CVE-2017-1000101", "CVE-2017-1000254");
script_xref(name:"DSA", value:"3992");
script_name(english:"Debian DSA-3992-1 : curl - security update");
script_summary(english:"Checks dpkg output for the updated package");
script_set_attribute(
attribute:"synopsis",
value:"The remote Debian host is missing a security-related update."
);
script_set_attribute(
attribute:"description",
value:
"Several vulnerabilities have been discovered in cURL, an URL transfer
library. The Common Vulnerabilities and Exposures project identifies
the following problems :
- CVE-2017-1000100
Even Rouault reported that cURL does not properly handle
long file names when doing an TFTP upload. A malicious
HTTP(S) server can take advantage of this flaw by
redirecting a client using the cURL library to a crafted
TFTP URL and trick it to send private memory contents to
a remote server over UDP.
- CVE-2017-1000101
Brian Carpenter and Yongji Ouyang reported that cURL
contains a flaw in the globbing function that parses the
numerical range, leading to an out-of-bounds read when
parsing a specially crafted URL.
- CVE-2017-1000254
Max Dymond reported that cURL contains an out-of-bounds
read flaw in the FTP PWD response parser. A malicious
server can take advantage of this flaw to effectively
prevent a client using the cURL library to work with it,
causing a denial of service."
);
script_set_attribute(
attribute:"see_also",
value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871554"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871555"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=877671"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2017-1000100"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2017-1000101"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2017-1000254"
);
script_set_attribute(
attribute:"see_also",
value:"https://packages.debian.org/source/jessie/curl"
);
script_set_attribute(
attribute:"see_also",
value:"https://packages.debian.org/source/stretch/curl"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.debian.org/security/2017/dsa-3992"
);
script_set_attribute(
attribute:"solution",
value:
"Upgrade the curl packages.
For the oldstable distribution (jessie), these problems have been
fixed in version 7.38.0-4+deb8u6.
For the stable distribution (stretch), these problems have been fixed
in version 7.52.1-5+deb9u1."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:curl");
script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:9.0");
script_set_attribute(attribute:"patch_publication_date", value:"2017/10/06");
script_set_attribute(attribute:"plugin_publication_date", value:"2017/10/09");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"Debian Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
exit(0);
}
include("audit.inc");
include("debian_package.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
flag = 0;
if (deb_check(release:"8.0", prefix:"curl", reference:"7.38.0-4+deb8u6")) flag++;
if (deb_check(release:"8.0", prefix:"libcurl3", reference:"7.38.0-4+deb8u6")) flag++;
if (deb_check(release:"8.0", prefix:"libcurl3-dbg", reference:"7.38.0-4+deb8u6")) flag++;
if (deb_check(release:"8.0", prefix:"libcurl3-gnutls", reference:"7.38.0-4+deb8u6")) flag++;
if (deb_check(release:"8.0", prefix:"libcurl3-nss", reference:"7.38.0-4+deb8u6")) flag++;
if (deb_check(release:"8.0", prefix:"libcurl4-doc", reference:"7.38.0-4+deb8u6")) flag++;
if (deb_check(release:"8.0", prefix:"libcurl4-gnutls-dev", reference:"7.38.0-4+deb8u6")) flag++;
if (deb_check(release:"8.0", prefix:"libcurl4-nss-dev", reference:"7.38.0-4+deb8u6")) flag++;
if (deb_check(release:"8.0", prefix:"libcurl4-openssl-dev", reference:"7.38.0-4+deb8u6")) flag++;
if (deb_check(release:"9.0", prefix:"curl", reference:"7.52.1-5+deb9u1")) flag++;
if (deb_check(release:"9.0", prefix:"libcurl3", reference:"7.52.1-5+deb9u1")) flag++;
if (deb_check(release:"9.0", prefix:"libcurl3-dbg", reference:"7.52.1-5+deb9u1")) flag++;
if (deb_check(release:"9.0", prefix:"libcurl3-gnutls", reference:"7.52.1-5+deb9u1")) flag++;
if (deb_check(release:"9.0", prefix:"libcurl3-nss", reference:"7.52.1-5+deb9u1")) flag++;
if (deb_check(release:"9.0", prefix:"libcurl4-doc", reference:"7.52.1-5+deb9u1")) flag++;
if (deb_check(release:"9.0", prefix:"libcurl4-gnutls-dev", reference:"7.52.1-5+deb9u1")) flag++;
if (deb_check(release:"9.0", prefix:"libcurl4-nss-dev", reference:"7.52.1-5+deb9u1")) flag++;
if (deb_check(release:"9.0", prefix:"libcurl4-openssl-dev", reference:"7.52.1-5+deb9u1")) flag++;
if (flag)
{
if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
else security_warning(0);
exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
{"id": "DEBIAN_DSA-3992.NASL", "bulletinFamily": "scanner", "title": "Debian DSA-3992-1 : curl - security update", "description": "Several vulnerabilities have been discovered in cURL, an URL transfer\nlibrary. The Common Vulnerabilities and Exposures project identifies\nthe following problems :\n\n - CVE-2017-1000100\n Even Rouault reported that cURL does not properly handle\n long file names when doing an TFTP upload. A malicious\n HTTP(S) server can take advantage of this flaw by\n redirecting a client using the cURL library to a crafted\n TFTP URL and trick it to send private memory contents to\n a remote server over UDP.\n\n - CVE-2017-1000101\n Brian Carpenter and Yongji Ouyang reported that cURL\n contains a flaw in the globbing function that parses the\n numerical range, leading to an out-of-bounds read when\n parsing a specially crafted URL.\n\n - CVE-2017-1000254\n Max Dymond reported that cURL contains an out-of-bounds\n read flaw in the FTP PWD response parser. A malicious\n server can take advantage of this flaw to effectively\n prevent a client using the cURL library to work with it,\n causing a denial of service.", "published": "2017-10-09T00:00:00", "modified": "2017-10-09T00:00:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "href": "https://www.tenable.com/plugins/nessus/103715", "reporter": "This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://packages.debian.org/source/jessie/curl", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871554", "https://packages.debian.org/source/stretch/curl", "https://security-tracker.debian.org/tracker/CVE-2017-1000254", "https://www.debian.org/security/2017/dsa-3992", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871555", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=877671", "https://security-tracker.debian.org/tracker/CVE-2017-1000101", "https://security-tracker.debian.org/tracker/CVE-2017-1000100"], "cvelist": ["CVE-2017-1000254", "CVE-2017-1000101", "CVE-2017-1000100"], "type": "nessus", "lastseen": "2021-01-06T09:50:52", "edition": 29, "viewCount": 2, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2017-1000100", "CVE-2017-1000254", "CVE-2017-1000101"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562311220191163", "OPENVAS:1361412562311220171287", "OPENVAS:1361412562310873507", "OPENVAS:1361412562310873268", "OPENVAS:1361412562311220171288", "OPENVAS:1361412562310843328", "OPENVAS:1361412562310891062", "OPENVAS:1361412562310873264", "OPENVAS:1361412562310703992", "OPENVAS:1361412562310891121"]}, {"type": "debian", "idList": ["DEBIAN:DLA-1121-1:CE806", "DEBIAN:DLA-1062-1:B8EF3", "DEBIAN:DSA-3992-1:EE5A8"]}, {"type": "ubuntu", "idList": ["USN-3441-2", "USN-3441-1"]}, {"type": "cloudfoundry", "idList": ["CFOUNDRY:4CFCCAC7D8EED4AADC23078DD6BCE0FD"]}, {"type": "nessus", "idList": ["PHOTONOS_PHSA-2017-0045_CURL.NASL", "PHOTONOS_PHSA-2017-0045.NASL", "OPENSUSE-2017-951.NASL", "UBUNTU_USN-3441-1.NASL", "FREEBSD_PKG_69CFA3867CD011E7867FB499BAEBFEAF.NASL", "SUSE_SU-2017-2174-1.NASL", "FEDORA_2017-F2DF9D7772.NASL", "FEDORA_2017-F1FFD18079.NASL", "SLACKWARE_SSA_2017-221-01.NASL", "ALA_ALAS-2017-889.NASL"]}, {"type": "fedora", "idList": ["FEDORA:0F821601EDCC", "FEDORA:07E88601F374", "FEDORA:5C8E66094E72", "FEDORA:4B79E60877A0", "FEDORA:87D78601E81F", "FEDORA:2516F60DE59E", "FEDORA:2E38A6085FA7"]}, {"type": "slackware", "idList": ["SSA-2017-221-01", "SSA-2017-279-01"]}, {"type": "freebsd", "idList": ["69CFA386-7CD0-11E7-867F-B499BAEBFEAF", "CCACE707-A8D8-11E7-AC58-B499BAEBFEAF"]}, {"type": "amazon", "idList": ["ALAS-2017-889", "ALAS-2017-919", "ALAS2-2019-1162"]}, {"type": "archlinux", "idList": ["ASA-201710-2", "ASA-201710-5", "ASA-201710-7", "ASA-201710-6", "ASA-201710-3", "ASA-201710-4", "ASA-201708-16"]}, {"type": "gentoo", "idList": ["GLSA-201709-14", "GLSA-201712-04"]}, {"type": "hackerone", "idList": ["H1:255587"]}, {"type": "suse", "idList": ["SUSE-SU-2017:2470-1", "SUSE-SU-2017:2701-1"]}, {"type": "redhat", "idList": ["RHSA-2018:2486", "RHSA-2018:3558"]}, {"type": "apple", "idList": ["APPLE:HT208331"]}], "modified": "2021-01-06T09:50:52", "rev": 2}, "score": {"value": 6.5, "vector": "NONE", "modified": "2021-01-06T09:50:52", "rev": 2}, "vulnersScore": 6.5}, "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3992. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(103715);\n script_version(\"3.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2017-1000100\", \"CVE-2017-1000101\", \"CVE-2017-1000254\");\n script_xref(name:\"DSA\", value:\"3992\");\n\n script_name(english:\"Debian DSA-3992-1 : curl - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities have been discovered in cURL, an URL transfer\nlibrary. The Common Vulnerabilities and Exposures project identifies\nthe following problems :\n\n - CVE-2017-1000100\n Even Rouault reported that cURL does not properly handle\n long file names when doing an TFTP upload. A malicious\n HTTP(S) server can take advantage of this flaw by\n redirecting a client using the cURL library to a crafted\n TFTP URL and trick it to send private memory contents to\n a remote server over UDP.\n\n - CVE-2017-1000101\n Brian Carpenter and Yongji Ouyang reported that cURL\n contains a flaw in the globbing function that parses the\n numerical range, leading to an out-of-bounds read when\n parsing a specially crafted URL.\n\n - CVE-2017-1000254\n Max Dymond reported that cURL contains an out-of-bounds\n read flaw in the FTP PWD response parser. A malicious\n server can take advantage of this flaw to effectively\n prevent a client using the cURL library to work with it,\n causing a denial of service.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871554\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871555\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=877671\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-1000100\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-1000101\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-1000254\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/curl\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/stretch/curl\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2017/dsa-3992\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the curl packages.\n\nFor the oldstable distribution (jessie), these problems have been\nfixed in version 7.38.0-4+deb8u6.\n\nFor the stable distribution (stretch), these problems have been fixed\nin version 7.52.1-5+deb9u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:9.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/10/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/10/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"curl\", reference:\"7.38.0-4+deb8u6\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libcurl3\", reference:\"7.38.0-4+deb8u6\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libcurl3-dbg\", reference:\"7.38.0-4+deb8u6\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libcurl3-gnutls\", reference:\"7.38.0-4+deb8u6\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libcurl3-nss\", reference:\"7.38.0-4+deb8u6\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libcurl4-doc\", reference:\"7.38.0-4+deb8u6\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libcurl4-gnutls-dev\", reference:\"7.38.0-4+deb8u6\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libcurl4-nss-dev\", reference:\"7.38.0-4+deb8u6\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libcurl4-openssl-dev\", reference:\"7.38.0-4+deb8u6\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"curl\", reference:\"7.52.1-5+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libcurl3\", reference:\"7.52.1-5+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libcurl3-dbg\", reference:\"7.52.1-5+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libcurl3-gnutls\", reference:\"7.52.1-5+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libcurl3-nss\", reference:\"7.52.1-5+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libcurl4-doc\", reference:\"7.52.1-5+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libcurl4-gnutls-dev\", reference:\"7.52.1-5+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libcurl4-nss-dev\", reference:\"7.52.1-5+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libcurl4-openssl-dev\", reference:\"7.52.1-5+deb9u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "naslFamily": "Debian Local Security Checks", "pluginID": "103715", "cpe": ["cpe:/o:debian:debian_linux:8.0", "p-cpe:/a:debian:debian_linux:curl", "cpe:/o:debian:debian_linux:9.0"], "scheme": null, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}
{"cve": [{"lastseen": "2020-10-03T13:07:30", "description": "curl supports \"globbing\" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.", "edition": 3, "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 3.6}, "published": "2017-10-05T01:29:00", "title": "CVE-2017-1000101", "type": "cve", "cwe": ["CWE-119"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-1000101"], "modified": "2018-11-13T11:29:00", "cpe": ["cpe:/a:haxx:curl:7.43.0", "cpe:/a:haxx:curl:7.47.1", "cpe:/a:haxx:curl:7.54.0", "cpe:/a:haxx:curl:7.50.0", "cpe:/a:haxx:curl:7.53.1", "cpe:/a:haxx:curl:7.4.1", "cpe:/a:haxx:curl:7.35.0", "cpe:/a:haxx:curl:7.53.0", "cpe:/a:haxx:curl:7.41.0", "cpe:/a:haxx:curl:7.37.0", "cpe:/a:haxx:curl:7.49.0", "cpe:/a:haxx:curl:7.46.0", "cpe:/a:haxx:curl:7.50.1", "cpe:/a:haxx:curl:7.40.0", "cpe:/a:haxx:curl:7.42.0", "cpe:/a:haxx:curl:7.45.0", "cpe:/a:haxx:curl:7.36.0", "cpe:/a:haxx:curl:7.47.0", "cpe:/a:haxx:curl:7.52.0", "cpe:/a:haxx:curl:7.42.1", "cpe:/a:haxx:curl:7.44.0", "cpe:/a:haxx:curl:7.39.0", "cpe:/a:haxx:curl:7.37.1", "cpe:/a:haxx:curl:7.48.0", "cpe:/a:haxx:curl:7.55.0", "cpe:/a:haxx:curl:7.51.0", "cpe:/a:haxx:curl:7.38.0", "cpe:/a:haxx:curl:7.52.1", "cpe:/a:haxx:curl:7.49.1", "cpe:/a:haxx:curl:7.50.3", "cpe:/a:haxx:curl:7.50.2", "cpe:/a:haxx:curl:7.54.1"], "id": "CVE-2017-1000101", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000101", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:haxx:curl:7.49.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.39.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.42.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.47.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.53.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.44.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.35.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.46.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.43.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.54.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.50.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.40.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.37.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.47.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.50.3:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.42.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.52.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.37.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.36.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.38.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.52.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.50.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.54.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.49.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.41.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.55.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.51.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.45.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.50.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.53.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:curl:7.48.0:*:*:*:*:*:*:*"]}, {"lastseen": "2020-10-03T13:07:31", "description": "libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.", "edition": 3, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2017-10-06T13:29:00", "title": "CVE-2017-1000254", "type": "cve", "cwe": ["CWE-119"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-1000254"], "modified": "2018-11-13T11:29:00", "cpe": ["cpe:/a:haxx:libcurl:7.31.0", "cpe:/a:haxx:libcurl:7.16.0", "cpe:/a:haxx:libcurl:7.41.0", "cpe:/a:haxx:libcurl:7.13.1", "cpe:/a:haxx:libcurl:7.45.0", "cpe:/a:haxx:libcurl:7.8.1", "cpe:/a:haxx:libcurl:7.44.0", "cpe:/a:haxx:libcurl:7.9.5", "cpe:/a:haxx:libcurl:7.9.8", "cpe:/a:haxx:libcurl:7.10.4", "cpe:/a:haxx:libcurl:7.51.0", "cpe:/a:haxx:libcurl:7.29.0", "cpe:/a:haxx:libcurl:7.16.1", "cpe:/a:haxx:libcurl:7.7.3", "cpe:/a:haxx:libcurl:7.9.2", "cpe:/a:haxx:libcurl:7.7.1", "cpe:/a:haxx:libcurl:7.9.7", "cpe:/a:haxx:libcurl:7.11.1", "cpe:/a:haxx:libcurl:7.40.0", "cpe:/a:haxx:libcurl:7.50.3", "cpe:/a:haxx:libcurl:7.18.1", "cpe:/a:haxx:libcurl:7.19.1", "cpe:/a:haxx:libcurl:7.50.0", "cpe:/a:haxx:libcurl:7.19.2", "cpe:/a:haxx:libcurl:7.22.0", "cpe:/a:haxx:libcurl:7.53.0", "cpe:/a:haxx:libcurl:7.35.0", "cpe:/a:haxx:libcurl:7.26.0", "cpe:/a:haxx:libcurl:7.8", "cpe:/a:haxx:libcurl:7.25.0", "cpe:/a:haxx:libcurl:7.21.4", "cpe:/a:haxx:libcurl:7.13.2", "cpe:/a:haxx:libcurl:7.34.0", "cpe:/a:haxx:libcurl:7.19.7", "cpe:/a:haxx:libcurl:7.47.1", "cpe:/a:haxx:libcurl:7.12.1", "cpe:/a:haxx:libcurl:7.9", "cpe:/a:haxx:libcurl:7.10.5", "cpe:/a:haxx:libcurl:7.15.5", "cpe:/a:haxx:libcurl:7.54.0", "cpe:/a:haxx:libcurl:7.33.0", "cpe:/a:haxx:libcurl:7.9.4", "cpe:/a:haxx:libcurl:7.20.0", "cpe:/a:haxx:libcurl:7.32.0", "cpe:/a:haxx:libcurl:7.43.0", "cpe:/a:haxx:libcurl:7.12.2", "cpe:/a:haxx:libcurl:7.16.2", "cpe:/a:haxx:libcurl:7.15.4", "cpe:/a:haxx:libcurl:7.19.6", "cpe:/a:haxx:libcurl:7.49.1", "cpe:/a:haxx:libcurl:7.48.0", "cpe:/a:haxx:libcurl:7.28.0", "cpe:/a:haxx:libcurl:7.15.2", "cpe:/a:haxx:libcurl:7.19.0", "cpe:/a:haxx:libcurl:7.10.1", "cpe:/a:haxx:libcurl:7.19.4", "cpe:/a:haxx:libcurl:7.15.0", "cpe:/a:haxx:libcurl:7.21.0", "cpe:/a:haxx:libcurl:7.11.0", "cpe:/a:haxx:libcurl:7.55.0", "cpe:/a:haxx:libcurl:7.12.0", "cpe:/a:haxx:libcurl:7.24.0", "cpe:/a:haxx:libcurl:7.10", "cpe:/a:haxx:libcurl:7.9.6", "cpe:/a:haxx:libcurl:7.36.0", "cpe:/a:haxx:libcurl:7.37.1", "cpe:/a:haxx:libcurl:7.16.3", "cpe:/a:haxx:libcurl:7.52.0", "cpe:/a:haxx:libcurl:7.14.1", "cpe:/a:haxx:libcurl:7.21.6", "cpe:/a:haxx:libcurl:7.42.1", "cpe:/a:haxx:libcurl:7.12.3", "cpe:/a:haxx:libcurl:7.23.0", "cpe:/a:haxx:libcurl:7.38.0", "cpe:/a:haxx:libcurl:7.49.0", "cpe:/a:haxx:libcurl:7.17.0", "cpe:/a:haxx:libcurl:7.27.0", "cpe:/a:haxx:libcurl:7.52.1", "cpe:/a:haxx:libcurl:7.7", "cpe:/a:haxx:libcurl:7.28.1", "cpe:/a:haxx:libcurl:7.11.2", "cpe:/a:haxx:libcurl:7.16.4", "cpe:/a:haxx:libcurl:7.55.1", "cpe:/a:haxx:libcurl:7.47.0", "cpe:/a:haxx:libcurl:7.17.1", "cpe:/a:haxx:libcurl:7.53.1", "cpe:/a:haxx:libcurl:7.21.2", "cpe:/a:haxx:libcurl:7.14.0", "cpe:/a:haxx:libcurl:7.21.3", "cpe:/a:haxx:libcurl:7.10.2", "cpe:/a:haxx:libcurl:7.23.1", "cpe:/a:haxx:libcurl:7.20.1", "cpe:/a:haxx:libcurl:7.15.1", "cpe:/a:haxx:libcurl:7.10.3", "cpe:/a:haxx:libcurl:7.7.2", "cpe:/a:haxx:libcurl:7.13.0", "cpe:/a:haxx:libcurl:7.21.1", "cpe:/a:haxx:libcurl:7.39", "cpe:/a:haxx:libcurl:7.50.1", "cpe:/a:haxx:libcurl:7.46.0", "cpe:/a:haxx:libcurl:7.30.0", "cpe:/a:haxx:libcurl:7.9.1", "cpe:/a:haxx:libcurl:7.21.7", "cpe:/a:haxx:libcurl:7.50.2", "cpe:/a:haxx:libcurl:7.19.3", "cpe:/a:haxx:libcurl:7.21.5", "cpe:/a:haxx:libcurl:7.10.7", "cpe:/a:haxx:libcurl:7.9.3", "cpe:/a:haxx:libcurl:7.15.3", "cpe:/a:haxx:libcurl:7.10.6", "cpe:/a:haxx:libcurl:7.54.1", "cpe:/a:haxx:libcurl:7.18.0", "cpe:/a:haxx:libcurl:7.19.5", "cpe:/a:haxx:libcurl:7.10.8", "cpe:/a:haxx:libcurl:7.37.0", "cpe:/a:haxx:libcurl:7.42.0", "cpe:/a:haxx:libcurl:7.18.2"], "id": "CVE-2017-1000254", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000254", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:haxx:libcurl:7.26.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.12.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.16.3:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.19.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.46.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.27.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.16.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.7:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.32.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.40.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.18.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.9.6:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.21.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.21.6:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.19.7:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.11.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.19.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.10.8:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.10.5:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.15.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.37.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.13.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.51.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.50.3:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.35.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.14.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.42.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.44.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.17.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.23.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.34.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.17.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.11.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.15.4:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.48.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.24.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.18.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.9.7:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.19.4:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.9:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.19.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.28.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.20.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.39:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.13.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.10.4:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.36.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.19.3:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.15.5:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.20.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.52.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.10:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.10.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.10.7:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.50.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.9.8:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.19.6:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.54.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.21.3:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.9.4:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.25.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.55.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.47.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.13.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.15.3:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.21.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.52.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.21.4:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.15.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.50.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.9.5:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.16.4:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.9.3:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.23.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.16.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.53.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.55.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.9.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.54.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.16.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.45.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.22.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.28.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.49.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.10.3:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.12.3:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.38.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.14.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.21.7:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.37.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.53.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.11.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.7.3:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.43.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.7.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.7.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.15.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.42.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.21.5:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.31.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.8:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.19.5:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.41.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.12.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.12.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.47.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.18.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.29.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.10.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.50.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.30.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.33.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.21.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.10.6:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.49.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.8.1:*:*:*:*:*:*:*"]}, {"lastseen": "2020-10-03T13:07:30", "description": "When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.", "edition": 3, "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 3.6}, "published": "2017-10-05T01:29:00", "title": "CVE-2017-1000100", "type": "cve", "cwe": ["CWE-200"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-1000100"], "modified": "2018-11-13T11:29:00", "cpe": ["cpe:/a:haxx:libcurl:7.31.0", "cpe:/a:haxx:libcurl:7.16.0", "cpe:/a:haxx:libcurl:7.41.0", "cpe:/a:haxx:libcurl:7.45.0", "cpe:/a:haxx:libcurl:7.44.0", "cpe:/a:haxx:libcurl:7.51.0", "cpe:/a:haxx:libcurl:7.29.0", "cpe:/a:haxx:libcurl:7.16.1", "cpe:/a:haxx:libcurl:7.40.0", "cpe:/a:haxx:libcurl:7.50.3", "cpe:/a:haxx:libcurl:7.18.1", "cpe:/a:haxx:libcurl:7.19.1", "cpe:/a:haxx:libcurl:7.50.0", "cpe:/a:haxx:libcurl:7.19.2", "cpe:/a:haxx:libcurl:7.22.0", "cpe:/a:haxx:libcurl:7.53.0", "cpe:/a:haxx:libcurl:7.35.0", "cpe:/a:haxx:libcurl:7.26.0", "cpe:/a:haxx:libcurl:7.25.0", "cpe:/a:haxx:libcurl:7.21.4", "cpe:/a:haxx:libcurl:7.34.0", "cpe:/a:haxx:libcurl:7.19.7", "cpe:/a:haxx:libcurl:7.47.1", "cpe:/a:haxx:libcurl:7.15.5", "cpe:/a:haxx:libcurl:7.54.0", "cpe:/a:haxx:libcurl:7.33.0", "cpe:/a:haxx:libcurl:7.20.0", "cpe:/a:haxx:libcurl:7.32.0", "cpe:/a:haxx:libcurl:7.43.0", "cpe:/a:haxx:libcurl:7.16.2", "cpe:/a:haxx:libcurl:7.15.4", "cpe:/a:haxx:libcurl:7.19.6", "cpe:/a:haxx:libcurl:7.49.1", "cpe:/a:haxx:libcurl:7.48.0", "cpe:/a:haxx:libcurl:7.28.0", "cpe:/a:haxx:libcurl:7.15.2", "cpe:/a:haxx:libcurl:7.19.0", "cpe:/a:haxx:libcurl:7.19.4", "cpe:/a:haxx:libcurl:7.15.0", "cpe:/a:haxx:libcurl:7.21.0", "cpe:/a:haxx:libcurl:7.24.0", "cpe:/a:haxx:libcurl:7.36.0", "cpe:/a:haxx:libcurl:7.37.1", "cpe:/a:haxx:libcurl:7.16.3", "cpe:/a:haxx:libcurl:7.52.0", "cpe:/a:haxx:libcurl:7.21.6", "cpe:/a:haxx:libcurl:7.42.1", "cpe:/a:haxx:libcurl:7.23.0", "cpe:/a:haxx:libcurl:7.38.0", "cpe:/a:haxx:libcurl:7.49.0", "cpe:/a:haxx:libcurl:7.17.0", "cpe:/a:haxx:libcurl:7.27.0", "cpe:/a:haxx:libcurl:7.52.1", "cpe:/a:haxx:libcurl:7.28.1", "cpe:/a:haxx:libcurl:7.16.4", "cpe:/a:haxx:libcurl:7.47.0", "cpe:/a:haxx:libcurl:7.17.1", "cpe:/a:haxx:libcurl:7.53.1", "cpe:/a:haxx:libcurl:7.21.2", "cpe:/a:haxx:libcurl:7.21.3", "cpe:/a:haxx:libcurl:7.23.1", "cpe:/a:haxx:libcurl:7.20.1", "cpe:/a:haxx:libcurl:7.15.1", "cpe:/a:haxx:libcurl:7.21.1", "cpe:/a:haxx:libcurl:7.39", "cpe:/a:haxx:libcurl:7.50.1", "cpe:/a:haxx:libcurl:7.46.0", "cpe:/a:haxx:libcurl:7.30.0", "cpe:/a:haxx:libcurl:7.21.7", "cpe:/a:haxx:libcurl:7.50.2", "cpe:/a:haxx:libcurl:7.19.3", "cpe:/a:haxx:libcurl:7.21.5", "cpe:/a:haxx:libcurl:7.15.3", "cpe:/a:haxx:libcurl:7.54.1", "cpe:/a:haxx:libcurl:7.18.0", "cpe:/a:haxx:libcurl:7.19.5", "cpe:/a:haxx:libcurl:7.37.0", "cpe:/a:haxx:libcurl:7.42.0", "cpe:/a:haxx:libcurl:7.18.2"], "id": "CVE-2017-1000100", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000100", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:haxx:libcurl:7.26.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.16.3:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.19.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.46.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.27.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.16.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.32.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.40.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.18.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.21.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.21.6:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.19.7:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.19.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.15.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.37.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.51.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.50.3:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.35.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.42.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.44.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.17.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.23.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.34.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.17.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.15.4:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.48.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.24.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.18.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.19.4:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.19.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.28.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.20.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.39:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.36.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.19.3:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.15.5:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.20.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.52.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.50.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.19.6:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.54.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.21.3:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.25.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.47.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.15.3:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.21.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.52.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.21.4:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.15.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.50.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.16.4:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.23.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.16.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.53.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.54.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.16.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.45.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.22.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.28.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.49.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.38.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.21.7:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.37.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.53.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.43.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.15.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.42.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.21.5:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.31.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.19.5:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.41.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.47.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.18.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.29.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.50.2:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.30.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.33.0:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.21.1:*:*:*:*:*:*:*", "cpe:2.3:a:haxx:libcurl:7.49.1:*:*:*:*:*:*:*"]}], "openvas": [{"lastseen": "2019-05-29T18:33:53", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000254", "CVE-2017-1000101", "CVE-2017-1000100"], "description": "Several vulnerabilities have been discovered in cURL, an URL transfer\nlibrary. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:\n\nCVE-2017-1000100\nEven Rouault reported that cURL does not properly handle long file\nnames when doing an TFTP upload. A malicious HTTP(S) server can take\nadvantage of this flaw by redirecting a client using the cURL\nlibrary to a crafted TFTP URL and trick it to send private memory\ncontents to a remote server over UDP.\n\nCVE-2017-1000101\nBrian Carpenter and Yongji Ouyang reported that cURL contains a flaw\nin the globbing function that parses the numerical range, leading to\nan out-of-bounds read when parsing a specially crafted URL.\n\nCVE-2017-1000254\nMax Dymond reported that cURL contains an out-of-bounds read flaw in\nthe FTP PWD response parser. A malicious server can take advantage\nof this flaw to effectively prevent a client using the cURL library\nto work with it, causing a denial of service.", "modified": "2019-03-18T00:00:00", "published": "2017-10-06T00:00:00", "id": "OPENVAS:1361412562310703992", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310703992", "type": "openvas", "title": "Debian Security Advisory DSA 3992-1 (curl - security update)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: deb_3992.nasl 14280 2019-03-18 14:50:45Z cfischer $\n#\n# Auto-generated from advisory DSA 3992-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2017 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.703992\");\n script_version(\"$Revision: 14280 $\");\n script_cve_id(\"CVE-2017-1000100\", \"CVE-2017-1000101\", \"CVE-2017-1000254\");\n script_name(\"Debian Security Advisory DSA 3992-1 (curl - security update)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:50:45 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-10-06 00:00:00 +0200 (Fri, 06 Oct 2017)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2017/dsa-3992.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2017 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB(9|8)\");\n script_tag(name:\"affected\", value:\"curl on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the oldstable distribution (jessie), these problems have been fixed\nin version 7.38.0-4+deb8u6.\n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 7.52.1-5+deb9u1.\n\nWe recommend that you upgrade your curl packages.\");\n script_tag(name:\"summary\", value:\"Several vulnerabilities have been discovered in cURL, an URL transfer\nlibrary. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:\n\nCVE-2017-1000100\nEven Rouault reported that cURL does not properly handle long file\nnames when doing an TFTP upload. A malicious HTTP(S) server can take\nadvantage of this flaw by redirecting a client using the cURL\nlibrary to a crafted TFTP URL and trick it to send private memory\ncontents to a remote server over UDP.\n\nCVE-2017-1000101\nBrian Carpenter and Yongji Ouyang reported that cURL contains a flaw\nin the globbing function that parses the numerical range, leading to\nan out-of-bounds read when parsing a specially crafted URL.\n\nCVE-2017-1000254\nMax Dymond reported that cURL contains an out-of-bounds read flaw in\nthe FTP PWD response parser. A malicious server can take advantage\nof this flaw to effectively prevent a client using the cURL library\nto work with it, causing a denial of service.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"curl\", ver:\"7.52.1-5+deb9u1\", rls:\"DEB9\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcurl3\", ver:\"7.52.1-5+deb9u1\", rls:\"DEB9\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcurl3-dbg\", ver:\"7.52.1-5+deb9u1\", rls:\"DEB9\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcurl3-gnutls\", ver:\"7.52.1-5+deb9u1\", rls:\"DEB9\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcurl3-nss\", ver:\"7.52.1-5+deb9u1\", rls:\"DEB9\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcurl4-doc\", ver:\"7.52.1-5+deb9u1\", rls:\"DEB9\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcurl4-gnutls-dev\", ver:\"7.52.1-5+deb9u1\", rls:\"DEB9\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcurl4-nss-dev\", ver:\"7.52.1-5+deb9u1\", rls:\"DEB9\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcurl4-openssl-dev\", ver:\"7.52.1-5+deb9u1\", rls:\"DEB9\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"curl\", ver:\"7.38.0-4+deb8u6\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcurl3\", ver:\"7.38.0-4+deb8u6\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcurl3-dbg\", ver:\"7.38.0-4+deb8u6\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcurl3-gnutls\", ver:\"7.38.0-4+deb8u6\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcurl3-nss\", ver:\"7.38.0-4+deb8u6\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcurl4-doc\", ver:\"7.38.0-4+deb8u6\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcurl4-gnutls-dev\", ver:\"7.38.0-4+deb8u6\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcurl4-nss-dev\", ver:\"7.38.0-4+deb8u6\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libcurl4-openssl-dev\", ver:\"7.38.0-4+deb8u6\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:33:58", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-7407", "CVE-2017-1000254", "CVE-2017-1000101", "CVE-2017-1000100", "CVE-2016-9586"], "description": "The remote host is missing an update for the ", "modified": "2019-03-13T00:00:00", "published": "2017-10-11T00:00:00", "id": "OPENVAS:1361412562310843328", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310843328", "type": "openvas", "title": "Ubuntu Update for curl USN-3441-1", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_3441_1.nasl 14140 2019-03-13 12:26:09Z cfischer $\n#\n# Ubuntu Update for curl USN-3441-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.843328\");\n script_version(\"$Revision: 14140 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 13:26:09 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-10-11 09:57:05 +0200 (Wed, 11 Oct 2017)\");\n script_cve_id(\"CVE-2016-9586\", \"CVE-2017-1000100\", \"CVE-2017-1000101\",\n \"CVE-2017-1000254\", \"CVE-2017-7407\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for curl USN-3441-1\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'curl'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"Daniel Stenberg discovered that curl\n incorrectly handled large floating point output. A remote attacker could use\n this issue to cause curl to crash, resulting in a denial of service, or possibly\n execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu\n 16.04 LTS. (CVE-2016-9586) Even Rouault discovered that curl incorrectly handled\n large file names when doing TFTP transfers. A remote attacker could use this\n issue to cause curl to crash, resulting in a denial of service, or possibly\n obtain sensitive memory contents. (CVE-2017-1000100) Brian Carpenter and Yongji\n Ouyang discovered that curl incorrectly handled numerical range globbing. A\n remote attacker could use this issue to cause curl to crash, resulting in a\n denial of service, or possibly obtain sensitive memory contents.\n (CVE-2017-1000101) Max Dymond discovered that curl incorrectly handled FTP PWD\n responses. A remote attacker could use this issue to cause curl to crash,\n resulting in a denial of service. (CVE-2017-1000254) Brian Carpenter discovered\n that curl incorrectly handled the --write-out command line option. A local\n attacker could possibly use this issue to obtain sensitive memory contents.\n (CVE-2017-7407)\");\n script_tag(name:\"affected\", value:\"curl on Ubuntu 17.04,\n Ubuntu 16.04 LTS,\n Ubuntu 14.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"USN\", value:\"3441-1\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-3441-1/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU(14\\.04 LTS|17\\.04|16\\.04 LTS)\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU14.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"curl\", ver:\"7.35.0-1ubuntu2.11\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3:amd64\", ver:\"7.35.0-1ubuntu2.11\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-gnutls:amd64\", ver:\"7.35.0-1ubuntu2.11\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-nss:amd64\", ver:\"7.35.0-1ubuntu2.11\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU17.04\")\n{\n\n if ((res = isdpkgvuln(pkg:\"curl\", ver:\"7.52.1-4ubuntu1.2\", rls:\"UBUNTU17.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3:amd64\", ver:\"7.52.1-4ubuntu1.2\", rls:\"UBUNTU17.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3:i386\", ver:\"7.52.1-4ubuntu1.2\", rls:\"UBUNTU17.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-gnutls:amd64\", ver:\"7.52.1-4ubuntu1.2\", rls:\"UBUNTU17.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-gnutls:i386\", ver:\"7.52.1-4ubuntu1.2\", rls:\"UBUNTU17.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-nss:amd64\", ver:\"7.52.1-4ubuntu1.2\", rls:\"UBUNTU17.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-nss:i386\", ver:\"7.52.1-4ubuntu1.2\", rls:\"UBUNTU17.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU16.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"curl\", ver:\"7.47.0-1ubuntu2.3\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3:amd64\", ver:\"7.47.0-1ubuntu2.3\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3:i386\", ver:\"7.47.0-1ubuntu2.3\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-gnutls:amd64\", ver:\"7.47.0-1ubuntu2.3\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-gnutls:i386\", ver:\"7.47.0-1ubuntu2.3\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-nss:amd64\", ver:\"7.47.0-1ubuntu2.3\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libcurl3-nss:i386\", ver:\"7.47.0-1ubuntu2.3\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:34:16", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000101", "CVE-2017-1000100"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2017-08-14T00:00:00", "id": "OPENVAS:1361412562310873268", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310873268", "type": "openvas", "title": "Fedora Update for curl FEDORA-2017-f1ffd18079", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2017_f1ffd18079_curl_fc26.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for curl FEDORA-2017-f1ffd18079\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.873268\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-08-14 07:44:58 +0200 (Mon, 14 Aug 2017)\");\n script_cve_id(\"CVE-2017-1000100\", \"CVE-2017-1000101\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for curl FEDORA-2017-f1ffd18079\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'curl'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"curl on Fedora 26\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2017-f1ffd18079\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVTKXXSSRRMP62652U6F2GUBQFOOFHLZ\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC26\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC26\")\n{\n\n if ((res = isrpmvuln(pkg:\"curl\", rpm:\"curl~7.53.1~10.fc26\", rls:\"FC26\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-05-29T18:34:30", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000101", "CVE-2017-1000100"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2017-08-14T00:00:00", "id": "OPENVAS:1361412562310873264", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310873264", "type": "openvas", "title": "Fedora Update for curl FEDORA-2017-f2df9d7772", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2017_f2df9d7772_curl_fc25.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for curl FEDORA-2017-f2df9d7772\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.873264\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-08-14 07:44:47 +0200 (Mon, 14 Aug 2017)\");\n script_cve_id(\"CVE-2017-1000100\", \"CVE-2017-1000101\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for curl FEDORA-2017-f2df9d7772\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'curl'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"curl on Fedora 25\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2017-f2df9d7772\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GPL37DFMX7KV4HFA7LZ7CXMGMTQWUKYG\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC25\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC25\")\n{\n\n if ((res = isrpmvuln(pkg:\"curl\", rpm:\"curl~7.51.0~9.fc25\", rls:\"FC25\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-01-27T18:38:51", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000254"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220171288", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220171288", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2017-1288)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2017.1288\");\n script_version(\"2020-01-23T13:52:22+0000\");\n script_cve_id(\"CVE-2017-1000254\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 13:52:22 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:05:36 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2017-1288)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP2\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2017-1288\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2017-1288\");\n script_xref(name:\"URL\", value:\"https://github.com/curl/curl/commit/415d2e7cb7\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'curl' package(s) announced via the EulerOS-SA-2017-1288 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](see references), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.(CVE-2017-1000254)\");\n\n script_tag(name:\"affected\", value:\"'curl' package(s) on Huawei EulerOS V2.0SP2.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP2\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"curl\", rpm:\"curl~7.29.0~35.h13\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libcurl\", rpm:\"libcurl~7.29.0~35.h13\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libcurl-devel\", rpm:\"libcurl-devel~7.29.0~35.h13\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:34:24", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000254"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2017-10-21T00:00:00", "id": "OPENVAS:1361412562310873507", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310873507", "type": "openvas", "title": "Fedora Update for curl FEDORA-2017-601b4c20a4", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2017_601b4c20a4_curl_fc26.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for curl FEDORA-2017-601b4c20a4\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.873507\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-10-21 09:51:54 +0200 (Sat, 21 Oct 2017)\");\n script_cve_id(\"CVE-2017-1000254\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for curl FEDORA-2017-601b4c20a4\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'curl'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"curl on Fedora 26\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2017-601b4c20a4\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHUFGFYW5CHB262LLZAQLWANLP6KPM5O\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC26\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC26\")\n{\n\n if ((res = isrpmvuln(pkg:\"curl\", rpm:\"curl~7.53.1~11.fc26\", rls:\"FC26\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-01-29T20:06:50", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000254"], "description": "It was discovered that there was a out-of-bounds read vulnerability in\ncurl, a command-line and library for transferring data over HTTP/FTP,\netc. A malicious FTP server could abuse this to prevent curl-based\nclients from interacting with it.", "modified": "2020-01-29T00:00:00", "published": "2018-02-07T00:00:00", "id": "OPENVAS:1361412562310891121", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310891121", "type": "openvas", "title": "Debian LTS: Security Advisory for curl (DLA-1121-1)", "sourceData": "# Copyright (C) 2018 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.891121\");\n script_version(\"2020-01-29T08:22:52+0000\");\n script_cve_id(\"CVE-2017-1000254\");\n script_name(\"Debian LTS: Security Advisory for curl (DLA-1121-1)\");\n script_tag(name:\"last_modification\", value:\"2020-01-29 08:22:52 +0000 (Wed, 29 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2018-02-07 00:00:00 +0100 (Wed, 07 Feb 2018)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://lists.debian.org/debian-lts-announce/2017/10/msg00001.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB7\");\n\n script_tag(name:\"affected\", value:\"curl on Debian Linux\");\n\n script_tag(name:\"solution\", value:\"For Debian 7 'Wheezy', this issue has been fixed in curl version\n7.26.0-1+wheezy21.\n\nWe recommend that you upgrade your curl packages.\");\n\n script_tag(name:\"summary\", value:\"It was discovered that there was a out-of-bounds read vulnerability in\ncurl, a command-line and library for transferring data over HTTP/FTP,\netc. A malicious FTP server could abuse this to prevent curl-based\nclients from interacting with it.\");\n\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"curl\", ver:\"7.26.0-1+wheezy21\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libcurl3\", ver:\"7.26.0-1+wheezy21\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libcurl3-dbg\", ver:\"7.26.0-1+wheezy21\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libcurl3-gnutls\", ver:\"7.26.0-1+wheezy21\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libcurl3-nss\", ver:\"7.26.0-1+wheezy21\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libcurl4-gnutls-dev\", ver:\"7.26.0-1+wheezy21\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libcurl4-nss-dev\", ver:\"7.26.0-1+wheezy21\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libcurl4-openssl-dev\", ver:\"7.26.0-1+wheezy21\", rls:\"DEB7\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-01-27T18:34:33", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000254"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220171287", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220171287", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2017-1287)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2017.1287\");\n script_version(\"2020-01-23T13:52:22+0000\");\n script_cve_id(\"CVE-2017-1000254\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 13:52:22 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:05:35 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2017-1287)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP1\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2017-1287\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2017-1287\");\n script_xref(name:\"URL\", value:\"https://github.com/curl/curl/commit/415d2e7cb7\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'curl' package(s) announced via the EulerOS-SA-2017-1287 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](See references), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.(CVE-2017-1000254)\");\n\n script_tag(name:\"affected\", value:\"'curl' package(s) on Huawei EulerOS V2.0SP1.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP1\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"curl\", rpm:\"curl~7.29.0~35.h13\", rls:\"EULEROS-2.0SP1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libcurl\", rpm:\"libcurl~7.29.0~35.h13\", rls:\"EULEROS-2.0SP1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libcurl-devel\", rpm:\"libcurl-devel~7.29.0~35.h13\", rls:\"EULEROS-2.0SP1\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-01-27T18:39:02", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000100"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191163", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191163", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2019-1163)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1163\");\n script_version(\"2020-01-23T11:33:23+0000\");\n script_cve_id(\"CVE-2017-1000100\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 11:33:23 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:33:23 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2019-1163)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROSVIRT-2\\.5\\.3\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1163\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1163\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'curl' package(s) announced via the EulerOS-SA-2019-1163 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.CVE-2017-1000100\");\n\n script_tag(name:\"affected\", value:\"'curl' package(s) on Huawei EulerOS Virtualization 2.5.3.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROSVIRT-2.5.3\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"curl\", rpm:\"curl~7.29.0~35.h23\", rls:\"EULEROSVIRT-2.5.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libcurl\", rpm:\"libcurl~7.29.0~35.h23\", rls:\"EULEROSVIRT-2.5.3\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-01-27T18:36:45", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000100"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191083", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191083", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2019-1083)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1083\");\n script_version(\"2020-01-23T11:30:41+0000\");\n script_cve_id(\"CVE-2017-1000100\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 11:30:41 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:30:41 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2019-1083)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROSVIRT-2\\.5\\.2\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1083\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1083\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'curl' package(s) announced via the EulerOS-SA-2019-1083 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.(CVE-2017-1000100)\");\n\n script_tag(name:\"affected\", value:\"'curl' package(s) on Huawei EulerOS Virtualization 2.5.2.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROSVIRT-2.5.2\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"curl\", rpm:\"curl~7.29.0~35.h23\", rls:\"EULEROSVIRT-2.5.2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}], "debian": [{"lastseen": "2020-08-14T01:03:11", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000254", "CVE-2017-1000101", "CVE-2017-1000100"], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3992-1 security@debian.org\nhttps://www.debian.org/security/ Salvatore Bonaccorso\nOctober 06, 2017 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : curl\nCVE ID : CVE-2017-1000100 CVE-2017-1000101 CVE-2017-1000254\nDebian Bug : 871554 871555 877671\n\nSeveral vulnerabilities have been discovered in cURL, an URL transfer\nlibrary. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:\n\nCVE-2017-1000100\n\n Even Rouault reported that cURL does not properly handle long file\n names when doing an TFTP upload. A malicious HTTP(S) server can take\n advantage of this flaw by redirecting a client using the cURL\n library to a crafted TFTP URL and trick it to send private memory\n contents to a remote server over UDP.\n\nCVE-2017-1000101\n\n Brian Carpenter and Yongji Ouyang reported that cURL contains a flaw\n in the globbing function that parses the numerical range, leading to\n an out-of-bounds read when parsing a specially crafted URL.\n\nCVE-2017-1000254\n\n Max Dymond reported that cURL contains an out-of-bounds read flaw in\n the FTP PWD response parser. A malicious server can take advantage\n of this flaw to effectively prevent a client using the cURL library\n to work with it, causing a denial of service.\n\nFor the oldstable distribution (jessie), these problems have been fixed\nin version 7.38.0-4+deb8u6.\n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 7.52.1-5+deb9u1.\n\nWe recommend that you upgrade your curl packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 14, "modified": "2017-10-06T20:44:00", "published": "2017-10-06T20:44:00", "id": "DEBIAN:DSA-3992-1:EE5A8", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2017/msg00254.html", "title": "[SECURITY] [DSA 3992-1] curl security update", "type": "debian", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-30T02:21:55", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000254"], "description": "Package : curl\nVersion : 7.26.0-1+wheezy21\nCVE ID : CVE-2017-1000254\nDebian Bug : #877671\n\nIt was discovered that there was a out-of-bounds read vulnerability in\ncurl, a command-line and library for transferring data over HTTP/FTP,\netc. A malicious FTP server could abuse this to prevent curl-based\nclients from interacting with it.\n\nSee <https://curl.haxx.se/docs/adv_20171004.html> for more details.\n\nFor Debian 7 "Wheezy", this issue has been fixed in curl version\n7.26.0-1+wheezy21.\n\nWe recommend that you upgrade your curl packages.\n\n\nRegards,\n\n- -- \n ,''`.\n : :' : Chris Lamb\n `. `'` lamby@debian.org / chris-lamb.co.uk\n `-\n\n", "edition": 3, "modified": "2017-10-05T09:39:19", "published": "2017-10-05T09:39:19", "id": "DEBIAN:DLA-1121-1:CE806", "href": "https://lists.debian.org/debian-lts-announce/2017/debian-lts-announce-201710/msg00001.html", "title": "[SECURITY] [DLA 1121-1] curl security update", "type": "debian", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-30T02:21:19", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000100"], "description": "Package : curl\nVersion : 7.26.0-1+wheezy20\nCVE ID : CVE-2017-1000100\n\n\nCVE-2017-1000100\n Wrong handling of very long filenames during TFTP might result in\n curl sending more than buffer size.\n\n\nFor Debian 7 "Wheezy", this problem has been fixed in version\n7.26.0-1+wheezy20.\n\nWe recommend that you upgrade your curl packages.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS\n", "edition": 3, "modified": "2017-08-20T16:50:36", "published": "2017-08-20T16:50:36", "id": "DEBIAN:DLA-1062-1:B8EF3", "href": "https://lists.debian.org/debian-lts-announce/2017/debian-lts-announce-201708/msg00014.html", "title": "[SECURITY] [DLA 1062-1] curl security update", "type": "debian", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}], "ubuntu": [{"lastseen": "2020-07-02T11:43:52", "bulletinFamily": "unix", "cvelist": ["CVE-2017-7407", "CVE-2017-1000254", "CVE-2017-1000101", "CVE-2017-1000100", "CVE-2016-9586"], "description": "Daniel Stenberg discovered that curl incorrectly handled large floating \npoint output. A remote attacker could use this issue to cause curl to \ncrash, resulting in a denial of service, or possibly execute arbitrary \ncode. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. \n(CVE-2016-9586)\n\nEven Rouault discovered that curl incorrectly handled large file names when \ndoing TFTP transfers. A remote attacker could use this issue to cause curl \nto crash, resulting in a denial of service, or possibly obtain sensitive \nmemory contents. (CVE-2017-1000100)\n\nBrian Carpenter and Yongji Ouyang discovered that curl incorrectly handled \nnumerical range globbing. A remote attacker could use this issue to cause \ncurl to crash, resulting in a denial of service, or possibly obtain \nsensitive memory contents. (CVE-2017-1000101)\n\nMax Dymond discovered that curl incorrectly handled FTP PWD responses. A \nremote attacker could use this issue to cause curl to crash, resulting in a \ndenial of service. (CVE-2017-1000254)\n\nBrian Carpenter discovered that curl incorrectly handled the --write-out \ncommand line option. A local attacker could possibly use this issue to \nobtain sensitive memory contents. (CVE-2017-7407)", "edition": 6, "modified": "2017-10-10T00:00:00", "published": "2017-10-10T00:00:00", "id": "USN-3441-1", "href": "https://ubuntu.com/security/notices/USN-3441-1", "title": "curl vulnerabilities", "type": "ubuntu", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-07-02T11:38:23", "bulletinFamily": "unix", "cvelist": ["CVE-2017-7407", "CVE-2017-1000254", "CVE-2017-1000101", "CVE-2017-1000257", "CVE-2017-1000100", "CVE-2016-9586"], "description": "USN-3441-1 fixed several vulnerabilities in curl. This update \nprovides the corresponding update for Ubuntu 12.04 ESM.\n\nOriginal advisory details:\n\nDaniel Stenberg discovered that curl incorrectly handled large floating \npoint output. A remote attacker could use this issue to cause curl to \ncrash, resulting in a denial of service, or possibly execute arbitrary \ncode. (CVE-2016-9586)\n\nEven Rouault discovered that curl incorrectly handled large file names when \ndoing TFTP transfers. A remote attacker could use this issue to cause curl \nto crash, resulting in a denial of service, or possibly obtain sensitive \nmemory contents. (CVE-2017-1000100)\n\nBrian Carpenter and Yongji Ouyang discovered that curl incorrectly handled \nnumerical range globbing. A remote attacker could use this issue to cause \ncurl to crash, resulting in a denial of service, or possibly obtain \nsensitive memory contents. (CVE-2017-1000101)\n\nMax Dymond discovered that curl incorrectly handled FTP PWD responses. A \nremote attacker could use this issue to cause curl to crash, resulting in a \ndenial of service. (CVE-2017-1000254)\n\nBrian Carpenter discovered that curl incorrectly handled IMAP FETCH \nresponse lines. A remote attacker could use this issue to cause curl to \ncrash, resulting in a denial of service, or possibly execute arbitrary \ncode.(CVE-2017-1000257)\n\nBrian Carpenter discovered that curl incorrectly handled the --write-out \ncommand line option. A local attacker could possibly use this issue to \nobtain sensitive memory contents. (CVE-2017-7407)", "edition": 7, "modified": "2017-10-23T00:00:00", "published": "2017-10-23T00:00:00", "id": "USN-3441-2", "href": "https://ubuntu.com/security/notices/USN-3441-2", "title": "curl vulnerabilities", "type": "ubuntu", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "cloudfoundry": [{"lastseen": "2019-05-29T18:32:41", "bulletinFamily": "software", "cvelist": ["CVE-2017-7407", "CVE-2017-1000254", "CVE-2017-1000101", "CVE-2017-1000100", "CVE-2016-9586"], "description": "# \n\n# Severity\n\nMedium\n\n# Vendor\n\nCanonical Ubuntu\n\n# Versions Affected\n\n * Canonical Ubuntu 14.04\n\n# Description\n\nDaniel Stenberg discovered that curl incorrectly handled large floating point output. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. ([CVE-2016-9586](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-9586>))\n\nEven Rouault discovered that curl incorrectly handled large file names when doing TFTP transfers. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly obtain sensitive memory contents. ([CVE-2017-1000100](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-1000100>))\n\nBrian Carpenter and Yongji Ouyang discovered that curl incorrectly handled numerical range globbing. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly obtain sensitive memory contents. ([CVE-2017-1000101](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-1000101>))\n\nMax Dymond discovered that curl incorrectly handled FTP PWD responses. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service. ([CVE-2017-1000254](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-1000254>))\n\nBrian Carpenter discovered that curl incorrectly handled the \u2013write-out command line option. A local attacker could possibly use this issue to obtain sensitive memory contents. ([CVE-2017-7407](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-7407>))\n\n# Affected Cloud Foundry Products and Versions\n\n_Severity is medium unless otherwise noted._\n\n * Cloud Foundry BOSH stemcells are vulnerable, including: \n * 3363.x versions prior to 3363.40\n * 3421.x versions prior to 3421.29\n * 3445.x versions prior to 3445.15\n * All other stemcells not listed.\n * All versions of Cloud Foundry cflinuxfs2 prior to 1.160.0\n\n# Mitigation\n\nOSS users are strongly encouraged to follow one of the mitigations below:\n\n * The Cloud Foundry project recommends upgrading the following BOSH stemcells: \n * Upgrade 3363.x versions prior to 3363.40\n * Upgrade 3421.x versions prior to 3421.29\n * Upgrade 3445.x versions prior to 3445.15\n * All other stemcells should be upgraded to the latest version available on [bosh.io](<https://bosh.io>).\n * The Cloud Foundry project recommends that Cloud Foundry deployments run with cflinuxfs2 version 1.160.0 or later.\n\n# References\n\n * [USN-3441-1](<http://www.ubuntu.com/usn/usn-3441-1/>)\n * [CVE-2016-9586](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-9586>)\n * [CVE-2017-1000100](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-1000100>)\n * [CVE-2017-1000101](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-1000101>)\n * [CVE-2017-1000254](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-1000254>)\n * [CVE-2017-7407](<http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-7407>)\n", "edition": 6, "modified": "2017-11-01T00:00:00", "published": "2017-11-01T00:00:00", "id": "CFOUNDRY:4CFCCAC7D8EED4AADC23078DD6BCE0FD", "href": "https://www.cloudfoundry.org/blog/usn-3441-1/", "title": "USN-3441-1: curl vulnerabilities | Cloud Foundry", "type": "cloudfoundry", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2021-01-01T06:46:01", "description": "Daniel Stenberg discovered that curl incorrectly handled large\nfloating point output. A remote attacker could use this issue to cause\ncurl to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu\n16.04 LTS. (CVE-2016-9586)\n\nEven Rouault discovered that curl incorrectly handled large file names\nwhen doing TFTP transfers. A remote attacker could use this issue to\ncause curl to crash, resulting in a denial of service, or possibly\nobtain sensitive memory contents. (CVE-2017-1000100)\n\nBrian Carpenter and Yongji Ouyang discovered that curl incorrectly\nhandled numerical range globbing. A remote attacker could use this\nissue to cause curl to crash, resulting in a denial of service, or\npossibly obtain sensitive memory contents. (CVE-2017-1000101)\n\nMax Dymond discovered that curl incorrectly handled FTP PWD responses.\nA remote attacker could use this issue to cause curl to crash,\nresulting in a denial of service. (CVE-2017-1000254)\n\nBrian Carpenter discovered that curl incorrectly handled the\n--write-out command line option. A local attacker could possibly use\nthis issue to obtain sensitive memory contents. (CVE-2017-7407).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 33, "cvss3": {"score": 8.1, "vector": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2017-10-11T00:00:00", "title": "Ubuntu 14.04 LTS / 16.04 LTS / 17.04 : curl vulnerabilities (USN-3441-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-7407", "CVE-2017-1000254", "CVE-2017-1000101", "CVE-2017-1000100", "CVE-2016-9586"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/o:canonical:ubuntu_linux:17.04", "cpe:/o:canonical:ubuntu_linux:16.04", "p-cpe:/a:canonical:ubuntu_linux:curl", "p-cpe:/a:canonical:ubuntu_linux:libcurl3-nss", "p-cpe:/a:canonical:ubuntu_linux:libcurl3", "cpe:/o:canonical:ubuntu_linux:14.04", "p-cpe:/a:canonical:ubuntu_linux:libcurl3-gnutls"], "id": "UBUNTU_USN-3441-1.NASL", "href": "https://www.tenable.com/plugins/nessus/103773", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3441-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(103773);\n script_version(\"3.11\");\n script_cvs_date(\"Date: 2019/09/18 12:31:47\");\n\n script_cve_id(\"CVE-2016-9586\", \"CVE-2017-1000100\", \"CVE-2017-1000101\", \"CVE-2017-1000254\", \"CVE-2017-7407\");\n script_xref(name:\"USN\", value:\"3441-1\");\n\n script_name(english:\"Ubuntu 14.04 LTS / 16.04 LTS / 17.04 : curl vulnerabilities (USN-3441-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Daniel Stenberg discovered that curl incorrectly handled large\nfloating point output. A remote attacker could use this issue to cause\ncurl to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu\n16.04 LTS. (CVE-2016-9586)\n\nEven Rouault discovered that curl incorrectly handled large file names\nwhen doing TFTP transfers. A remote attacker could use this issue to\ncause curl to crash, resulting in a denial of service, or possibly\nobtain sensitive memory contents. (CVE-2017-1000100)\n\nBrian Carpenter and Yongji Ouyang discovered that curl incorrectly\nhandled numerical range globbing. A remote attacker could use this\nissue to cause curl to crash, resulting in a denial of service, or\npossibly obtain sensitive memory contents. (CVE-2017-1000101)\n\nMax Dymond discovered that curl incorrectly handled FTP PWD responses.\nA remote attacker could use this issue to cause curl to crash,\nresulting in a denial of service. (CVE-2017-1000254)\n\nBrian Carpenter discovered that curl incorrectly handled the\n--write-out command line option. A local attacker could possibly use\nthis issue to obtain sensitive memory contents. (CVE-2017-7407).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3441-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libcurl3\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libcurl3-gnutls\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libcurl3-nss\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:17.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/04/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/10/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/10/11\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(14\\.04|16\\.04|17\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 14.04 / 16.04 / 17.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"14.04\", pkgname:\"curl\", pkgver:\"7.35.0-1ubuntu2.11\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"libcurl3\", pkgver:\"7.35.0-1ubuntu2.11\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"libcurl3-gnutls\", pkgver:\"7.35.0-1ubuntu2.11\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"libcurl3-nss\", pkgver:\"7.35.0-1ubuntu2.11\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"curl\", pkgver:\"7.47.0-1ubuntu2.3\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"libcurl3\", pkgver:\"7.47.0-1ubuntu2.3\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"libcurl3-gnutls\", pkgver:\"7.47.0-1ubuntu2.3\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"libcurl3-nss\", pkgver:\"7.47.0-1ubuntu2.3\")) flag++;\nif (ubuntu_check(osver:\"17.04\", pkgname:\"curl\", pkgver:\"7.52.1-4ubuntu1.2\")) flag++;\nif (ubuntu_check(osver:\"17.04\", pkgname:\"libcurl3\", pkgver:\"7.52.1-4ubuntu1.2\")) flag++;\nif (ubuntu_check(osver:\"17.04\", pkgname:\"libcurl3-gnutls\", pkgver:\"7.52.1-4ubuntu1.2\")) flag++;\nif (ubuntu_check(osver:\"17.04\", pkgname:\"libcurl3-nss\", pkgver:\"7.52.1-4ubuntu1.2\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"curl / libcurl3 / libcurl3-gnutls / libcurl3-nss\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-03-17T22:39:22", "description": "An update of the curl package has been released.", "edition": 8, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2019-02-07T00:00:00", "title": "Photon OS 2.0: Curl PHSA-2017-0045", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15041", "CVE-2017-1000254", "CVE-2017-1000101", "CVE-2017-1000099", "CVE-2017-1000100"], "modified": "2019-02-07T00:00:00", "cpe": ["p-cpe:/a:vmware:photonos:curl", "cpe:/o:vmware:photonos:2.0"], "id": "PHOTONOS_PHSA-2017-0045_CURL.NASL", "href": "https://www.tenable.com/plugins/nessus/121761", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\n# The descriptive text and package checks in this plugin were\n# extracted from VMware Security Advisory PHSA-2017-0045. The text\n# itself is copyright (C) VMware, Inc.\n\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(121761);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2019/02/07\");\n\n script_cve_id(\n \"CVE-2017-1000099\",\n \"CVE-2017-1000100\",\n \"CVE-2017-1000101\",\n \"CVE-2017-1000254\"\n );\n\n script_name(english:\"Photon OS 2.0: Curl PHSA-2017-0045\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote PhotonOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"An update of the curl package has been released.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://github.com/vmware/photon/wiki/Security-Updates-2-2.md\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected Linux packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2017-15041\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/17\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/11/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/02/07\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:photonos:2.0\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"PhotonOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/PhotonOS/release\", \"Host/PhotonOS/rpm-list\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/PhotonOS/release\");\nif (isnull(release) || release !~ \"^VMware Photon\") audit(AUDIT_OS_NOT, \"PhotonOS\");\nif (release !~ \"^VMware Photon (?:Linux|OS) 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"PhotonOS 2.0\");\n\nif (!get_kb_item(\"Host/PhotonOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"PhotonOS\", cpu);\n\nflag = 0;\n\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"curl-7.54.1-3.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"curl-7.54.1-3.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"curl-7.54.1-3.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"curl-7.54.1-3.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"curl-debuginfo-7.54.1-3.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"curl-debuginfo-7.54.1-3.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"curl-debuginfo-7.54.1-3.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"curl-debuginfo-7.54.1-3.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"curl-devel-7.54.1-3.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"curl-devel-7.54.1-3.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"curl-devel-7.54.1-3.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"curl-devel-7.54.1-3.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"curl-libs-7.54.1-3.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"curl-libs-7.54.1-3.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"curl-libs-7.54.1-3.ph2\")) flag++;\nif (rpm_check(release:\"PhotonOS-2.0\", reference:\"curl-libs-7.54.1-3.ph2\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"curl\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-07T14:26:11", "description": "This update for curl fixes the following issues :\n\n - CVE-2017-1000100: TFP sends more than buffer size and it\n could lead to a denial of service (bsc#1051644)\n\n - CVE-2017-1000101: URL globbing out of bounds read could\n lead to a denial of service (bsc#1051643)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 29, "cvss3": {"score": 6.5, "vector": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}, "published": "2017-08-17T00:00:00", "title": "SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2017:2174-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000101", "CVE-2017-1000100"], "modified": "2017-08-17T00:00:00", "cpe": ["cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:curl-debuginfo", "p-cpe:/a:novell:suse_linux:curl", "p-cpe:/a:novell:suse_linux:libcurl4-debuginfo", "p-cpe:/a:novell:suse_linux:libcurl4", "p-cpe:/a:novell:suse_linux:curl-debugsource"], "id": "SUSE_SU-2017-2174-1.NASL", "href": "https://www.tenable.com/plugins/nessus/102540", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2017:2174-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(102540);\n script_version(\"3.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-1000100\", \"CVE-2017-1000101\");\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2017:2174-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for curl fixes the following issues :\n\n - CVE-2017-1000100: TFP sends more than buffer size and it\n could lead to a denial of service (bsc#1051644)\n\n - CVE-2017-1000101: URL globbing out of bounds read could\n lead to a denial of service (bsc#1051643)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1051643\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1051644\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-1000100/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-1000101/\"\n );\n # https://www.suse.com/support/update/announcement/2017/suse-su-20172174-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?5129d1e6\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t\npatch SUSE-SLE-SDK-12-SP3-2017-1335=1\n\nSUSE Linux Enterprise Software Development Kit 12-SP2:zypper in -t\npatch SUSE-SLE-SDK-12-SP2-2017-1335=1\n\nSUSE Linux Enterprise Server for Raspberry Pi 12-SP2:zypper in -t\npatch SUSE-SLE-RPI-12-SP2-2017-1335=1\n\nSUSE Linux Enterprise Server 12-SP3:zypper in -t patch\nSUSE-SLE-SERVER-12-SP3-2017-1335=1\n\nSUSE Linux Enterprise Server 12-SP2:zypper in -t patch\nSUSE-SLE-SERVER-12-SP2-2017-1335=1\n\nSUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP3-2017-1335=1\n\nSUSE Linux Enterprise Desktop 12-SP2:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP2-2017-1335=1\n\nSUSE Container as a Service Platform ALL:zypper in -t patch\nSUSE-CAASP-ALL-2017-1335=1\n\nOpenStack Cloud Magnum Orchestration 7:zypper in -t patch\nSUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-1335=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:curl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:curl-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libcurl4\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libcurl4-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/10/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/08/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/08/17\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(2|3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP2/3\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(2|3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP2/3\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"curl-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"curl-debuginfo-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"curl-debugsource-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libcurl4-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libcurl4-debuginfo-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libcurl4-32bit-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libcurl4-debuginfo-32bit-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"curl-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"curl-debuginfo-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"curl-debugsource-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"libcurl4-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"libcurl4-debuginfo-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"libcurl4-32bit-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"libcurl4-debuginfo-32bit-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"curl-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"curl-debuginfo-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"curl-debugsource-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libcurl4-32bit-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libcurl4-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libcurl4-debuginfo-32bit-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libcurl4-debuginfo-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"curl-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"curl-debuginfo-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"curl-debugsource-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"libcurl4-32bit-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"libcurl4-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"libcurl4-debuginfo-32bit-7.37.0-37.3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"libcurl4-debuginfo-7.37.0-37.3.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"curl\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-01-20T12:33:31", "description": "This update for curl fixes the following issues :\n\n - CVE-2017-1000100: TFP sends more than buffer size and it\n could lead to a denial of service (bsc#1051644)\n\n - CVE-2017-1000101: URL globbing out of bounds read could\n lead to a denial of service (bsc#1051643)\n\nThis update was imported from the SUSE:SLE-12:Update update project.", "edition": 20, "cvss3": {"score": 6.5, "vector": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}, "published": "2017-08-18T00:00:00", "title": "openSUSE Security Update : curl (openSUSE-2017-951)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000101", "CVE-2017-1000100"], "modified": "2017-08-18T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:libcurl-devel-32bit", "p-cpe:/a:novell:opensuse:curl-debuginfo", "p-cpe:/a:novell:opensuse:libcurl4-debuginfo-32bit", "p-cpe:/a:novell:opensuse:libcurl4", "p-cpe:/a:novell:opensuse:libcurl-devel", "cpe:/o:novell:opensuse:42.3", "cpe:/o:novell:opensuse:42.2", "p-cpe:/a:novell:opensuse:curl-debugsource", "p-cpe:/a:novell:opensuse:libcurl4-debuginfo", "p-cpe:/a:novell:opensuse:curl", "p-cpe:/a:novell:opensuse:libcurl4-32bit"], "id": "OPENSUSE-2017-951.NASL", "href": "https://www.tenable.com/plugins/nessus/102566", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2017-951.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(102566);\n script_version(\"3.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2017-1000100\", \"CVE-2017-1000101\");\n\n script_name(english:\"openSUSE Security Update : curl (openSUSE-2017-951)\");\n script_summary(english:\"Check for the openSUSE-2017-951 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for curl fixes the following issues :\n\n - CVE-2017-1000100: TFP sends more than buffer size and it\n could lead to a denial of service (bsc#1051644)\n\n - CVE-2017-1000101: URL globbing out of bounds read could\n lead to a denial of service (bsc#1051643)\n\nThis update was imported from the SUSE:SLE-12:Update update project.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1051643\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1051644\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected curl packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:curl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:curl-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcurl-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcurl-devel-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcurl4\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcurl4-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcurl4-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcurl4-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/08/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/08/18\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.2|SUSE42\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.2 / 42.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.2\", reference:\"curl-7.37.0-16.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"curl-debuginfo-7.37.0-16.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"curl-debugsource-7.37.0-16.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"libcurl-devel-7.37.0-16.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"libcurl4-7.37.0-16.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"libcurl4-debuginfo-7.37.0-16.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", cpu:\"x86_64\", reference:\"libcurl-devel-32bit-7.37.0-16.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", cpu:\"x86_64\", reference:\"libcurl4-32bit-7.37.0-16.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", cpu:\"x86_64\", reference:\"libcurl4-debuginfo-32bit-7.37.0-16.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"curl-7.37.0-20.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"curl-debuginfo-7.37.0-20.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"curl-debugsource-7.37.0-20.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libcurl-devel-7.37.0-20.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libcurl4-7.37.0-20.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libcurl4-debuginfo-7.37.0-20.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libcurl-devel-32bit-7.37.0-20.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libcurl4-32bit-7.37.0-20.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libcurl4-debuginfo-32bit-7.37.0-20.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"curl / curl-debuginfo / curl-debugsource / libcurl-devel-32bit / etc\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-01-17T09:11:03", "description": "New curl packages are available for Slackware 13.0, 13.1, 13.37,\n14.0, 14.1, 14.2, and -current to fix security issues.", "edition": 27, "cvss3": {"score": 6.5, "vector": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}, "published": "2017-08-11T00:00:00", "title": "Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : curl (SSA:2017-221-01)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000101", "CVE-2017-1000099", "CVE-2017-1000100"], "modified": "2017-08-11T00:00:00", "cpe": ["cpe:/o:slackware:slackware_linux:14.2", "cpe:/o:slackware:slackware_linux:14.1", "cpe:/o:slackware:slackware_linux:13.37", "cpe:/o:slackware:slackware_linux:14.0", "cpe:/o:slackware:slackware_linux:13.0", "cpe:/o:slackware:slackware_linux", "p-cpe:/a:slackware:slackware_linux:curl", "cpe:/o:slackware:slackware_linux:13.1"], "id": "SLACKWARE_SSA_2017-221-01.NASL", "href": "https://www.tenable.com/plugins/nessus/102365", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Slackware Security Advisory 2017-221-01. The text \n# itself is copyright (C) Slackware Linux, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(102365);\n script_version(\"3.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2017-1000099\", \"CVE-2017-1000100\", \"CVE-2017-1000101\");\n script_xref(name:\"SSA\", value:\"2017-221-01\");\n\n script_name(english:\"Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : curl (SSA:2017-221-01)\");\n script_summary(english:\"Checks for updated package in /var/log/packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Slackware host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"New curl packages are available for Slackware 13.0, 13.1, 13.37,\n14.0, 14.1, 14.2, and -current to fix security issues.\"\n );\n # http://www.slackware.com/security/viewer.php?l=slackware-security&y=2017&m=slackware-security.557504\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?091c1890\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected curl package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:13.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:13.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:13.37\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:14.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:14.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:14.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/08/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/08/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Slackware Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Slackware/release\", \"Host/Slackware/packages\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"slackware.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Slackware/release\")) audit(AUDIT_OS_NOT, \"Slackware\");\nif (!get_kb_item(\"Host/Slackware/packages\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Slackware\", cpu);\n\n\nflag = 0;\nif (slackware_check(osver:\"13.0\", pkgname:\"curl\", pkgver:\"7.55.0\", pkgarch:\"i486\", pkgnum:\"1_slack13.0\")) flag++;\nif (slackware_check(osver:\"13.0\", arch:\"x86_64\", pkgname:\"curl\", pkgver:\"7.55.0\", pkgarch:\"x86_64\", pkgnum:\"1_slack13.0\")) flag++;\n\nif (slackware_check(osver:\"13.1\", pkgname:\"curl\", pkgver:\"7.55.0\", pkgarch:\"i486\", pkgnum:\"1_slack13.1\")) flag++;\nif (slackware_check(osver:\"13.1\", arch:\"x86_64\", pkgname:\"curl\", pkgver:\"7.55.0\", pkgarch:\"x86_64\", pkgnum:\"1_slack13.1\")) flag++;\n\nif (slackware_check(osver:\"13.37\", pkgname:\"curl\", pkgver:\"7.55.0\", pkgarch:\"i486\", pkgnum:\"1_slack13.37\")) flag++;\nif (slackware_check(osver:\"13.37\", arch:\"x86_64\", pkgname:\"curl\", pkgver:\"7.55.0\", pkgarch:\"x86_64\", pkgnum:\"1_slack13.37\")) flag++;\n\nif (slackware_check(osver:\"14.0\", pkgname:\"curl\", pkgver:\"7.55.0\", pkgarch:\"i486\", pkgnum:\"1_slack14.0\")) flag++;\nif (slackware_check(osver:\"14.0\", arch:\"x86_64\", pkgname:\"curl\", pkgver:\"7.55.0\", pkgarch:\"x86_64\", pkgnum:\"1_slack14.0\")) flag++;\n\nif (slackware_check(osver:\"14.1\", pkgname:\"curl\", pkgver:\"7.55.0\", pkgarch:\"i486\", pkgnum:\"1_slack14.1\")) flag++;\nif (slackware_check(osver:\"14.1\", arch:\"x86_64\", pkgname:\"curl\", pkgver:\"7.55.0\", pkgarch:\"x86_64\", pkgnum:\"1_slack14.1\")) flag++;\n\nif (slackware_check(osver:\"14.2\", pkgname:\"curl\", pkgver:\"7.55.0\", pkgarch:\"i586\", pkgnum:\"1_slack14.2\")) flag++;\nif (slackware_check(osver:\"14.2\", arch:\"x86_64\", pkgname:\"curl\", pkgver:\"7.55.0\", pkgarch:\"x86_64\", pkgnum:\"1_slack14.2\")) flag++;\n\nif (slackware_check(osver:\"current\", pkgname:\"curl\", pkgver:\"7.55.0\", pkgarch:\"i586\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"current\", arch:\"x86_64\", pkgname:\"curl\", pkgver:\"7.55.0\", pkgarch:\"x86_64\", pkgnum:\"1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:slackware_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-01-06T10:52:51", "description": "The cURL project reports :\n\n- FILE buffer read out of bounds\n\n- TFTP sends more than buffer size\n\n- URL globbing out of bounds read", "edition": 26, "cvss3": {"score": 6.5, "vector": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}, "published": "2017-08-10T00:00:00", "title": "FreeBSD : cURL -- multiple vulnerabilities (69cfa386-7cd0-11e7-867f-b499baebfeaf)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000101", "CVE-2017-1000099", "CVE-2017-1000100"], "modified": "2017-08-10T00:00:00", "cpe": ["cpe:/o:freebsd:freebsd", "p-cpe:/a:freebsd:freebsd:curl"], "id": "FREEBSD_PKG_69CFA3867CD011E7867FB499BAEBFEAF.NASL", "href": "https://www.tenable.com/plugins/nessus/102330", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(102330);\n script_version(\"3.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2017-1000099\", \"CVE-2017-1000100\", \"CVE-2017-1000101\");\n\n script_name(english:\"FreeBSD : cURL -- multiple vulnerabilities (69cfa386-7cd0-11e7-867f-b499baebfeaf)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The cURL project reports :\n\n- FILE buffer read out of bounds\n\n- TFTP sends more than buffer size\n\n- URL globbing out of bounds read\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://curl.haxx.se/docs/security.html\"\n );\n # https://vuxml.freebsd.org/freebsd/69cfa386-7cd0-11e7-867f-b499baebfeaf.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?7dcd3b62\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/08/09\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/08/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/08/10\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"curl<7.55.0\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-01-07T10:14:43", "description": "Security fixes for CVE-2017-1000100 and CVE-2017-1000101\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 20, "cvss3": {"score": 6.5, "vector": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}, "published": "2017-08-14T00:00:00", "title": "Fedora 26 : curl (2017-f1ffd18079)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000101", "CVE-2017-1000099", "CVE-2017-1000100"], "modified": "2017-08-14T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:curl", "cpe:/o:fedoraproject:fedora:26"], "id": "FEDORA_2017-F1FFD18079.NASL", "href": "https://www.tenable.com/plugins/nessus/102462", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-f1ffd18079.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(102462);\n script_version(\"3.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-1000099\", \"CVE-2017-1000100\", \"CVE-2017-1000101\");\n script_xref(name:\"FEDORA\", value:\"2017-f1ffd18079\");\n\n script_name(english:\"Fedora 26 : curl (2017-f1ffd18079)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Security fixes for CVE-2017-1000100 and CVE-2017-1000101\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-f1ffd18079\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected curl package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:26\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/10/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/08/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/08/14\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^26([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 26\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC26\", reference:\"curl-7.53.1-10.fc26\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"curl\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-01-07T10:14:45", "description": "Security fixes for CVE-2017-1000100 and CVE-2017-1000101\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 20, "cvss3": {"score": 6.5, "vector": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}, "published": "2017-08-14T00:00:00", "title": "Fedora 25 : curl (2017-f2df9d7772)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000101", "CVE-2017-1000099", "CVE-2017-1000100"], "modified": "2017-08-14T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:25", "p-cpe:/a:fedoraproject:fedora:curl"], "id": "FEDORA_2017-F2DF9D7772.NASL", "href": "https://www.tenable.com/plugins/nessus/102463", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-f2df9d7772.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(102463);\n script_version(\"3.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-1000099\", \"CVE-2017-1000100\", \"CVE-2017-1000101\");\n script_xref(name:\"FEDORA\", value:\"2017-f2df9d7772\");\n\n script_name(english:\"Fedora 25 : curl (2017-f2df9d7772)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Security fixes for CVE-2017-1000100 and CVE-2017-1000101\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-f2df9d7772\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected curl package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:25\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/10/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/08/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/08/14\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^25([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 25\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC25\", reference:\"curl-7.51.0-9.fc25\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"curl\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-01-01T01:19:39", "description": "FILE buffer read out of bounds (CVE-2017-1000099)\n\nTFTP sends more than buffer size (CVE-2017-1000100)\n\nURL globbing out of bounds read (CVE-2017-1000101)", "edition": 24, "cvss3": {"score": 6.5, "vector": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}, "published": "2017-09-01T00:00:00", "title": "Amazon Linux AMI : curl (ALAS-2017-889)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000101", "CVE-2017-1000099", "CVE-2017-1000100"], "modified": "2021-01-02T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:libcurl", "p-cpe:/a:amazon:linux:libcurl-devel", "p-cpe:/a:amazon:linux:curl-debuginfo", "cpe:/o:amazon:linux", "p-cpe:/a:amazon:linux:curl"], "id": "ALA_ALAS-2017-889.NASL", "href": "https://www.tenable.com/plugins/nessus/102877", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux AMI Security Advisory ALAS-2017-889.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(102877);\n script_version(\"3.4\");\n script_cvs_date(\"Date: 2018/04/18 15:09:36\");\n\n script_cve_id(\"CVE-2017-1000099\", \"CVE-2017-1000100\", \"CVE-2017-1000101\");\n script_xref(name:\"ALAS\", value:\"2017-889\");\n\n script_name(english:\"Amazon Linux AMI : curl (ALAS-2017-889)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Amazon Linux AMI host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"FILE buffer read out of bounds (CVE-2017-1000099)\n\nTFTP sends more than buffer size (CVE-2017-1000100)\n\nURL globbing out of bounds read (CVE-2017-1000101)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://alas.aws.amazon.com/ALAS-2017-889.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Run 'yum update curl' to update your system.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:curl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:libcurl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:libcurl-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/08/31\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/09/01\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nos_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"A\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux AMI\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (rpm_check(release:\"ALA\", reference:\"curl-7.51.0-9.75.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"curl-debuginfo-7.51.0-9.75.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"libcurl-7.51.0-9.75.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"libcurl-devel-7.51.0-9.75.amzn1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"curl / curl-debuginfo / libcurl / libcurl-devel\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-02-21T01:41:53", "description": "An update of [go,curl,libtiff,systemd,bash] packages for PhotonOS has been released.", "edition": 6, "published": "2018-08-17T00:00:00", "title": "Photon OS 2.0: Bash / Curl / Go / Libtiff / Systemd PHSA-2017-0045 (deprecated)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-15041", "CVE-2017-15908", "CVE-2017-1000254", "CVE-2017-1000101", "CVE-2016-9401", "CVE-2017-1000099", "CVE-2017-12944", "CVE-2017-1000100"], "modified": "2019-02-07T00:00:00", "cpe": ["p-cpe:/a:vmware:photonos:libtiff", "p-cpe:/a:vmware:photonos:bash", "p-cpe:/a:vmware:photonos:systemd", "p-cpe:/a:vmware:photonos:go", "p-cpe:/a:vmware:photonos:curl", "cpe:/o:vmware:photonos:2.0"], "id": "PHOTONOS_PHSA-2017-0045.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=111894", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# @DEPRECATED@\n#\n# Disabled on 2/7/2019\n#\n\n# The descriptive text and package checks in this plugin were\n# extracted from VMware Security Advisory PHSA-2017-0045. The text\n# itself is copyright (C) VMware, Inc.\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(111894);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2019/02/07 18:59:50\");\n\n script_cve_id(\n \"CVE-2016-9401\",\n \"CVE-2017-12944\",\n \"CVE-2017-15041\",\n \"CVE-2017-15908\",\n \"CVE-2017-1000099\",\n \"CVE-2017-1000100\",\n \"CVE-2017-1000101\",\n \"CVE-2017-1000254\"\n );\n\n script_name(english:\"Photon OS 2.0: Bash / Curl / Go / Libtiff / Systemd PHSA-2017-0045 (deprecated)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"This plugin has been deprecated.\");\n script_set_attribute(attribute:\"description\", value:\n\"An update of [go,curl,libtiff,systemd,bash] packages for PhotonOS has\nbeen released.\");\n # https://github.com/vmware/photon/wiki/Security-Updates-2-2\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?6dc68905\");\n script_set_attribute(attribute:\"solution\", value:\"n/a.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2017-15041\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/11/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/08/17\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:bash\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:curl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:go\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:libtiff\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:systemd\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:photonos:2.0\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"PhotonOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/PhotonOS/release\", \"Host/PhotonOS/rpm-list\");\n\n exit(0);\n}\n\nexit(0, \"This plugin has been deprecated.\");\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/PhotonOS/release\");\nif (isnull(release) || release !~ \"^VMware Photon\") audit(AUDIT_OS_NOT, \"PhotonOS\");\nif (release !~ \"^VMware Photon (?:Linux|OS) 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"PhotonOS 2.0\");\n\nif (!get_kb_item(\"Host/PhotonOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"PhotonOS\", cpu);\n\nflag = 0;\n\npkgs = [\n \"bash-4.4.12-1.ph2\",\n \"bash-debuginfo-4.4.12-1.ph2\",\n \"bash-devel-4.4.12-1.ph2\",\n \"bash-lang-4.4.12-1.ph2\",\n \"curl-7.54.1-3.ph2\",\n \"curl-debuginfo-7.54.1-3.ph2\",\n \"curl-devel-7.54.1-3.ph2\",\n \"curl-libs-7.54.1-3.ph2\",\n \"go-1.9.1-1.ph2\",\n \"go-debuginfo-1.9.1-1.ph2\",\n \"libtiff-4.0.8-5.ph2\",\n \"libtiff-debuginfo-4.0.8-5.ph2\",\n \"libtiff-devel-4.0.8-5.ph2\",\n \"systemd-233-11.ph2\",\n \"systemd-debuginfo-233-11.ph2\",\n \"systemd-devel-233-11.ph2\",\n \"systemd-lang-233-11.ph2\"\n];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"PhotonOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"bash / curl / go / libtiff / systemd\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "fedora": [{"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000100", "CVE-2017-1000101"], "description": "curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer resume, proxy tunneling and a busload of other useful tricks. ", "modified": "2017-08-14T00:56:15", "published": "2017-08-14T00:56:15", "id": "FEDORA:2E38A6085FA7", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 25 Update: curl-7.51.0-9.fc25", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000100", "CVE-2017-1000101"], "description": "curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer resume, proxy tunneling and a busload of other useful tricks. ", "modified": "2017-08-13T20:56:17", "published": "2017-08-13T20:56:17", "id": "FEDORA:0F821601EDCC", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 26 Update: curl-7.53.1-10.fc26", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000254"], "description": "curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer resume, proxy tunneling and a busload of other useful tricks. ", "modified": "2017-10-16T17:57:00", "published": "2017-10-16T17:57:00", "id": "FEDORA:07E88601F374", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 26 Update: curl-7.53.1-11.fc26", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000254"], "description": "curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer resume, proxy tunneling and a busload of other useful tricks. ", "modified": "2017-11-11T03:23:12", "published": "2017-11-11T03:23:12", "id": "FEDORA:2516F60DE59E", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: curl-7.55.1-6.fc27", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000254"], "description": "curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer resume, proxy tunneling and a busload of other useful tricks. ", "modified": "2017-11-11T13:41:16", "published": "2017-11-11T13:41:16", "id": "FEDORA:4B79E60877A0", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: curl-7.55.1-6.fc27", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-100025", "CVE-2017-1000254", "CVE-2017-8816", "CVE-2017-8817", "CVE-2018-1000005", "CVE-2018-1000007", "CVE-2018-1000121", "CVE-2018-1000122", "CVE-2018-1000300", "CVE-2018-1000301"], "description": "curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer resume, proxy tunneling and a busload of other useful tricks. ", "modified": "2018-05-23T16:00:01", "published": "2018-05-23T16:00:01", "id": "FEDORA:5C8E66094E72", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: curl-7.55.1-11.fc27", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:55", "bulletinFamily": "unix", "cvelist": ["CVE-2017-100025", "CVE-2017-1000254", "CVE-2017-8816", "CVE-2017-8817", "CVE-2018-1000005", "CVE-2018-1000007", "CVE-2018-1000121", "CVE-2018-1000122", "CVE-2018-1000300", "CVE-2018-1000301", "CVE-2018-14618"], "description": "curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer resume, proxy tunneling and a busload of other useful tricks. ", "modified": "2018-09-20T18:18:52", "published": "2018-09-20T18:18:52", "id": "FEDORA:87D78601E81F", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: curl-7.55.1-14.fc27", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "slackware": [{"lastseen": "2020-10-25T16:36:18", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000099", "CVE-2017-1000100", "CVE-2017-1000101"], "description": "New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,\n14.2, and -current to fix security issues.\n\n\nHere are the details from the Slackware 14.2 ChangeLog:\n\npatches/packages/curl-7.55.0-i586-1_slack14.2.txz: Upgraded.\n This update fixes three security issues:\n URL globbing out of bounds read\n TFTP sends more than buffer size\n FILE buffer read out of bounds\n For more information, see:\n https://curl.haxx.se/docs/adv_20170809A.html\n https://curl.haxx.se/docs/adv_20170809B.html\n https://curl.haxx.se/docs/adv_20170809C.html\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000101\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000100\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000099\n (* Security fix *)\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated package for Slackware 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/curl-7.55.0-i486-1_slack13.0.txz\n\nUpdated package for Slackware x86_64 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/curl-7.55.0-x86_64-1_slack13.0.txz\n\nUpdated package for Slackware 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/curl-7.55.0-i486-1_slack13.1.txz\n\nUpdated package for Slackware x86_64 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/curl-7.55.0-x86_64-1_slack13.1.txz\n\nUpdated package for Slackware 13.37:\nftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/curl-7.55.0-i486-1_slack13.37.txz\n\nUpdated package for Slackware x86_64 13.37:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/curl-7.55.0-x86_64-1_slack13.37.txz\n\nUpdated package for Slackware 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/curl-7.55.0-i486-1_slack14.0.txz\n\nUpdated package for Slackware x86_64 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/curl-7.55.0-x86_64-1_slack14.0.txz\n\nUpdated package for Slackware 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/curl-7.55.0-i486-1_slack14.1.txz\n\nUpdated package for Slackware x86_64 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/curl-7.55.0-x86_64-1_slack14.1.txz\n\nUpdated package for Slackware 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/curl-7.55.0-i586-1_slack14.2.txz\n\nUpdated package for Slackware x86_64 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/curl-7.55.0-x86_64-1_slack14.2.txz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/curl-7.55.0-i586-1.txz\n\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/curl-7.55.0-x86_64-1.txz\n\n\nMD5 signatures:\n\nSlackware 13.0 package:\ncd2da3b2f3b5f82dc65f9d059cf1e218 curl-7.55.0-i486-1_slack13.0.txz\n\nSlackware x86_64 13.0 package:\n2d4196ad8fca7d47e98abc8509edcbb9 curl-7.55.0-x86_64-1_slack13.0.txz\n\nSlackware 13.1 package:\n3761487e1a01dd6dc6a7380a562ee063 curl-7.55.0-i486-1_slack13.1.txz\n\nSlackware x86_64 13.1 package:\ncb1a111bf84e4fa83b7b1f6c513edc2b curl-7.55.0-x86_64-1_slack13.1.txz\n\nSlackware 13.37 package:\n0211314fd5e14089f2f9e343fc43d11f curl-7.55.0-i486-1_slack13.37.txz\n\nSlackware x86_64 13.37 package:\nb9d8bf85e21e1ae75dcee5024252bd2a curl-7.55.0-x86_64-1_slack13.37.txz\n\nSlackware 14.0 package:\n86e0cbb23b946d6dbf80502780ee2e6b curl-7.55.0-i486-1_slack14.0.txz\n\nSlackware x86_64 14.0 package:\n9587b1e01071e3f0273f59af9314fa1a curl-7.55.0-x86_64-1_slack14.0.txz\n\nSlackware 14.1 package:\nebdcc7de218cd7d5a17bf155ae2e176f curl-7.55.0-i486-1_slack14.1.txz\n\nSlackware x86_64 14.1 package:\n452baffbd32f0f39092750e9cacc194d curl-7.55.0-x86_64-1_slack14.1.txz\n\nSlackware 14.2 package:\n38407eb05a8c2b4b0c43b6e545a87298 curl-7.55.0-i586-1_slack14.2.txz\n\nSlackware x86_64 14.2 package:\n30a06330c38cdab72b1dfa73fcd425ef curl-7.55.0-x86_64-1_slack14.2.txz\n\nSlackware -current package:\n0e9db7d8fc7d5e272e5406225307c030 n/curl-7.55.0-i586-1.txz\n\nSlackware x86_64 -current package:\n830246f0db066b1417556fff89199cb3 n/curl-7.55.0-x86_64-1.txz\n\n\nInstallation instructions:\n\nUpgrade the package as root:\n > upgradepkg curl-7.55.0-i586-1_slack14.2.txz", "modified": "2017-08-09T20:47:02", "published": "2017-08-09T20:47:02", "id": "SSA-2017-221-01", "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2017&m=slackware-security.557504", "type": "slackware", "title": "[slackware-security] curl", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-10-25T16:36:07", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000254"], "description": "New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to\nfix a security issue.\n\n\nHere are the details from the Slackware 14.2 ChangeLog:\n\npatches/packages/curl-7.56.0-i586-1_slack14.2.txz: Upgraded.\n This update fixes a security issue:\n libcurl may read outside of a heap allocated buffer when doing FTP.\n For more information, see:\n https://curl.haxx.se/docs/adv_20171004.html\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000254\n (* Security fix *)\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated package for Slackware 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/curl-7.56.0-i486-1_slack14.0.txz\n\nUpdated package for Slackware x86_64 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/curl-7.56.0-x86_64-1_slack14.0.txz\n\nUpdated package for Slackware 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/curl-7.56.0-i486-1_slack14.1.txz\n\nUpdated package for Slackware x86_64 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/curl-7.56.0-x86_64-1_slack14.1.txz\n\nUpdated package for Slackware 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/curl-7.56.0-i586-1_slack14.2.txz\n\nUpdated package for Slackware x86_64 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/curl-7.56.0-x86_64-1_slack14.2.txz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/curl-7.56.0-i586-1.txz\n\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/curl-7.56.0-x86_64-1.txz\n\n\nMD5 signatures:\n\nSlackware 14.0 package:\n880c7281862df00ffe344295bd422f7a curl-7.56.0-i486-1_slack14.0.txz\n\nSlackware x86_64 14.0 package:\n6025ce06e93ddf6520f5bc731ff0888d curl-7.56.0-x86_64-1_slack14.0.txz\n\nSlackware 14.1 package:\n0d887113412626fcc3f4fefa72456a6c curl-7.56.0-i486-1_slack14.1.txz\n\nSlackware x86_64 14.1 package:\n1d99e50e4a8f0ea7efe4784fb0b68ac8 curl-7.56.0-x86_64-1_slack14.1.txz\n\nSlackware 14.2 package:\n4130d13192b46d033d7d7931628733d5 curl-7.56.0-i586-1_slack14.2.txz\n\nSlackware x86_64 14.2 package:\nde3bf8673814b9a4f07b04de8719357a curl-7.56.0-x86_64-1_slack14.2.txz\n\nSlackware -current package:\n80d914f7e63eaef96538ae032227dfea n/curl-7.56.0-i586-1.txz\n\nSlackware x86_64 -current package:\n19b32807404f534a5ce33cd0a3f31a01 n/curl-7.56.0-x86_64-1.txz\n\n\nInstallation instructions:\n\nUpgrade the package as root:\n > upgradepkg curl-7.56.0-i586-1_slack14.2.txz", "modified": "2017-10-06T06:33:52", "published": "2017-10-06T06:33:52", "id": "SSA-2017-279-01", "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2017&m=slackware-security.419253", "type": "slackware", "title": "[slackware-security] curl", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "freebsd": [{"lastseen": "2019-05-29T18:32:13", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000101", "CVE-2017-1000099", "CVE-2017-1000100"], "description": "\nThe cURL project reports:\n\n\nFILE buffer read out of bounds\nTFTP sends more than buffer size\nURL globbing out of bounds read\n\n\n", "edition": 6, "modified": "2017-08-09T00:00:00", "published": "2017-08-09T00:00:00", "id": "69CFA386-7CD0-11E7-867F-B499BAEBFEAF", "href": "https://vuxml.freebsd.org/freebsd/69cfa386-7cd0-11e7-867f-b499baebfeaf.html", "title": "cURL -- multiple vulnerabilities", "type": "freebsd", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-05-29T18:32:09", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000254"], "description": "\nThe cURL project reports:\n\nFTP PWD response parser out of bounds read\nlibcurl may read outside of a heap allocated buffer when doing FTP.\nWhen libcurl connects to an FTP server and successfully logs in\n\t (anonymous or not), it asks the server for the current directory with\n\t the PWD command. The server then responds with a 257 response containing\n\t the path, inside double quotes. The returned path name is then kept by\n\t libcurl for subsequent uses.\nDue to a flaw in the string parser for this directory name, a directory\n\t name passed like this but without a closing double quote would lead to\n\t libcurl not adding a trailing NUL byte to the buffer holding the name.\n\t When libcurl would then later access the string, it could read beyond\n\t the allocated heap buffer and crash or wrongly access data beyond the\n\t buffer, thinking it was part of the path.\nA malicious server could abuse this fact and effectively prevent\n\t libcurl-based clients to work with it - the PWD command is always issued\n\t on new FTP connections and the mistake has a high chance of causing a\n\t segfault.\n\n", "edition": 5, "modified": "2017-10-04T00:00:00", "published": "2017-10-04T00:00:00", "id": "CCACE707-A8D8-11E7-AC58-B499BAEBFEAF", "href": "https://vuxml.freebsd.org/freebsd/ccace707-a8d8-11e7-ac58-b499baebfeaf.html", "title": "cURL -- out of bounds read", "type": "freebsd", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "amazon": [{"lastseen": "2020-11-10T12:36:11", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000101", "CVE-2017-1000099", "CVE-2017-1000100"], "description": "**Issue Overview:**\n\nFILE buffer read out of bounds ([CVE-2017-1000099 __](<https://access.redhat.com/security/cve/CVE-2017-1000099>))\n\nTFTP sends more than buffer size ([CVE-2017-1000100 __](<https://access.redhat.com/security/cve/CVE-2017-1000100>))\n\nURL globbing out of bounds read ([CVE-2017-1000101 __](<https://access.redhat.com/security/cve/CVE-2017-1000101>))\n\n \n**Affected Packages:** \n\n\ncurl\n\n \n**Issue Correction:** \nRun _yum update curl_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n i686: \n curl-7.51.0-9.75.amzn1.i686 \n curl-debuginfo-7.51.0-9.75.amzn1.i686 \n libcurl-devel-7.51.0-9.75.amzn1.i686 \n libcurl-7.51.0-9.75.amzn1.i686 \n \n src: \n curl-7.51.0-9.75.amzn1.src \n \n x86_64: \n libcurl-devel-7.51.0-9.75.amzn1.x86_64 \n curl-7.51.0-9.75.amzn1.x86_64 \n curl-debuginfo-7.51.0-9.75.amzn1.x86_64 \n libcurl-7.51.0-9.75.amzn1.x86_64 \n \n \n", "edition": 4, "modified": "2017-08-31T17:19:00", "published": "2017-08-31T17:19:00", "id": "ALAS-2017-889", "href": "https://alas.aws.amazon.com/ALAS-2017-889.html", "title": "Medium: curl", "type": "amazon", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-11-10T12:35:08", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000254"], "description": "**Issue Overview:**\n\nFTP PWD response parser out of bounds read \nlibcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote. ([CVE-2017-1000254 __](<https://access.redhat.com/security/cve/CVE-2017-1000254>) )\n\n \n**Affected Packages:** \n\n\ncurl\n\n \n**Issue Correction:** \nRun _yum update curl_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n i686: \n curl-debuginfo-7.53.1-11.78.amzn1.i686 \n libcurl-7.53.1-11.78.amzn1.i686 \n curl-7.53.1-11.78.amzn1.i686 \n libcurl-devel-7.53.1-11.78.amzn1.i686 \n \n src: \n curl-7.53.1-11.78.amzn1.src \n \n x86_64: \n curl-7.53.1-11.78.amzn1.x86_64 \n libcurl-7.53.1-11.78.amzn1.x86_64 \n curl-debuginfo-7.53.1-11.78.amzn1.x86_64 \n libcurl-devel-7.53.1-11.78.amzn1.x86_64 \n \n \n", "edition": 4, "modified": "2017-11-02T20:18:00", "published": "2017-11-02T20:18:00", "id": "ALAS-2017-919", "href": "https://alas.aws.amazon.com/ALAS-2017-919.html", "title": "Medium: curl", "type": "amazon", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-11-10T12:37:24", "bulletinFamily": "unix", "cvelist": ["CVE-2019-3823", "CVE-2018-16840", "CVE-2017-8817", "CVE-2017-1000254", "CVE-2018-16890", "CVE-2017-8818", "CVE-2017-8816", "CVE-2017-1000257", "CVE-2019-3822", "CVE-2018-20483", "CVE-2018-16839", "CVE-2018-16842"], "description": "**Issue Overview:**\n\nlibcurl is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.([CVE-2018-16890 __](<https://access.redhat.com/security/cve/CVE-2018-16890>)) \n\nThe NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.([CVE-2017-8816 __](<https://access.redhat.com/security/cve/CVE-2017-8816>))\n\ncurl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library.([CVE-2017-8818 __](<https://access.redhat.com/security/cve/CVE-2017-8818>))\n\nlibcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.([CVE-2017-1000254 __](<https://access.redhat.com/security/cve/CVE-2017-1000254>))\n\nCurl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.([CVE-2018-16842 __](<https://access.redhat.com/security/cve/CVE-2018-16842>))\n\nlibcurl is vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.([CVE-2019-3822 __](<https://access.redhat.com/security/cve/CVE-2019-3822>))\n\nlibcurl is vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.([CVE-2019-3823 __](<https://access.redhat.com/security/cve/CVE-2019-3823>))\n\nThe FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.([CVE-2017-8817 __](<https://access.redhat.com/security/cve/CVE-2017-8817>))\n\nset_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.([CVE-2018-20483 __](<https://access.redhat.com/security/cve/CVE-2018-20483>))\n\nA buffer overrun flaw was found in the IMAP handler of libcurl. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the application.([CVE-2017-1000257 __](<https://access.redhat.com/security/cve/CVE-2017-1000257>))\n\nA heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.([CVE-2018-16840 __](<https://access.redhat.com/security/cve/CVE-2018-16840>))\n\nCurl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.([CVE-2018-16839 __](<https://access.redhat.com/security/cve/CVE-2018-16839>))\n\n \n**Affected Packages:** \n\n\ncurl\n\n \n**Issue Correction:** \nRun _yum update curl_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n aarch64: \n curl-7.61.1-9.amzn2.0.1.aarch64 \n libcurl-7.61.1-9.amzn2.0.1.aarch64 \n libcurl-devel-7.61.1-9.amzn2.0.1.aarch64 \n curl-debuginfo-7.61.1-9.amzn2.0.1.aarch64 \n \n i686: \n curl-7.61.1-9.amzn2.0.1.i686 \n libcurl-7.61.1-9.amzn2.0.1.i686 \n libcurl-devel-7.61.1-9.amzn2.0.1.i686 \n curl-debuginfo-7.61.1-9.amzn2.0.1.i686 \n \n src: \n curl-7.61.1-9.amzn2.0.1.src \n \n x86_64: \n curl-7.61.1-9.amzn2.0.1.x86_64 \n libcurl-7.61.1-9.amzn2.0.1.x86_64 \n libcurl-devel-7.61.1-9.amzn2.0.1.x86_64 \n curl-debuginfo-7.61.1-9.amzn2.0.1.x86_64 \n \n \n", "edition": 1, "modified": "2019-02-16T00:34:00", "published": "2019-02-16T00:34:00", "id": "ALAS2-2019-1162", "href": "https://alas.aws.amazon.com/AL2/ALAS-2019-1162.html", "title": "Medium: curl", "type": "amazon", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "archlinux": [{"lastseen": "2020-09-22T18:36:43", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000099", "CVE-2017-1000100", "CVE-2017-1000101"], "description": "Arch Linux Security Advisory ASA-201708-16\n==========================================\n\nSeverity: Medium\nDate : 2017-08-22\nCVE-ID : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000101\nPackage : curl\nType : information disclosure\nRemote : Yes\nLink : https://security.archlinux.org/AVG-370\n\nSummary\n=======\n\nThe package curl before version 7.55-1 is vulnerable to information\ndisclosure.\n\nResolution\n==========\n\nUpgrade to 7.55-1.\n\n# pacman -Syu \"curl>=7.55-1\"\n\nThe problems have been fixed upstream in version 7.55.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\n- CVE-2017-1000099 (information disclosure)\n\nAn information disclosure issue has been found in curl < 7.55.0. When\nasking to get a file from a file:// URL, libcurl provides a feature\nthat outputs meta-data about the file using HTTP-like headers. The code\ndoing this would send the wrong buffer to the user (stdout or the\napplication's provide callback), which could lead to other private data\nfrom the heap to get inadvertently displayed. The wrong buffer was an\nuninitialized memory area allocated on the heap and if it turned out to\nnot contain any zero byte, it would continue and display the data\nfollowing that buffer in memory.\n\n- CVE-2017-1000100 (information disclosure)\n\nAn information disclosure issue has been found in curl < 7.55.0. When\ndoing a TFTP transfer and curl/libcurl is given a URL that contains a\nvery long file name (longer than about 515 bytes), the file name is\ntruncated to fit within the buffer boundaries, but the buffer size is\nstill wrongly updated to use the untruncated length. This too large\nvalue is then used in the sendto() call, making curl attempt to send\nmore data than what is actually put into the buffer. The sendto()\nfunction will then read beyond the end of the heap based buffer.\nA malicious HTTP(S) server could redirect a vulnerable libcurl-using\nclient to a crafted TFTP URL (if the client hasn't restricted which\nprotocols it allows redirects to) and trick it to send private memory\ncontents to a remote server over UDP.\n\n- CVE-2017-1000101 (information disclosure)\n\nA heap-based read buffer overflow has been found in curl < 7.55.0. In\nthe globbing function that parses the numerical range, there was an\nomission that made curl read a byte beyond the end of the URL if given\na carefully crafted, or just wrongly written, URL. The URL is stored in\na heap based buffer, so it could then be made to wrongly read something\nelse instead of crashing. An example of a URL that triggers the flaw\nwould be http://ur%20[0-60000000000000000000. This flaw only affects\nthe curl command line tool, not the libcurl library.\n\nImpact\n======\n\nAn attacker is able to read sensitive information by asking curl to\nretrieve a maliciously crafted URL.\n\nReferences\n==========\n\nhttps://curl.haxx.se/docs/adv_20170809C.html\nhttps://curl.haxx.se/CVE-2017-1000099.patch\nhttps://curl.haxx.se/docs/adv_20170809B.html\nhttps://curl.haxx.se/CVE-2017-1000100.patch\nhttps://curl.haxx.se/docs/adv_20170809A.html\nhttps://curl.haxx.se/CVE-2017-1000101.patch\nhttps://security.archlinux.org/CVE-2017-1000099\nhttps://security.archlinux.org/CVE-2017-1000100\nhttps://security.archlinux.org/CVE-2017-1000101", "modified": "2017-08-22T00:00:00", "published": "2017-08-22T00:00:00", "id": "ASA-201708-16", "href": "https://security.archlinux.org/ASA-201708-16", "type": "archlinux", "title": "[ASA-201708-16] curl: information disclosure", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-09-22T18:36:42", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000099", "CVE-2017-1000100", "CVE-2017-1000254"], "description": "Arch Linux Security Advisory ASA-201710-6\n=========================================\n\nSeverity: Medium\nDate : 2017-10-05\nCVE-ID : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000254\nPackage : lib32-libcurl-compat\nType : multiple issues\nRemote : Yes\nLink : https://security.archlinux.org/AVG-388\n\nSummary\n=======\n\nThe package lib32-libcurl-compat before version 7.56.0-1 is vulnerable\nto multiple issues including information disclosure and denial of\nservice.\n\nResolution\n==========\n\nUpgrade to 7.56.0-1.\n\n# pacman -Syu \"lib32-libcurl-compat>=7.56.0-1\"\n\nThe problems have been fixed upstream in version 7.56.0.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\n- CVE-2017-1000099 (information disclosure)\n\nAn information disclosure issue has been found in curl < 7.55.0. When\nasking to get a file from a file:// URL, libcurl provides a feature\nthat outputs meta-data about the file using HTTP-like headers. The code\ndoing this would send the wrong buffer to the user (stdout or the\napplication's provide callback), which could lead to other private data\nfrom the heap to get inadvertently displayed. The wrong buffer was an\nuninitialized memory area allocated on the heap and if it turned out to\nnot contain any zero byte, it would continue and display the data\nfollowing that buffer in memory.\n\n- CVE-2017-1000100 (information disclosure)\n\nAn information disclosure issue has been found in curl < 7.55.0. When\ndoing a TFTP transfer and curl/libcurl is given a URL that contains a\nvery long file name (longer than about 515 bytes), the file name is\ntruncated to fit within the buffer boundaries, but the buffer size is\nstill wrongly updated to use the untruncated length. This too large\nvalue is then used in the sendto() call, making curl attempt to send\nmore data than what is actually put into the buffer. The sendto()\nfunction will then read beyond the end of the heap based buffer.\nA malicious HTTP(S) server could redirect a vulnerable libcurl-using\nclient to a crafted TFTP URL (if the client hasn't restricted which\nprotocols it allows redirects to) and trick it to send private memory\ncontents to a remote server over UDP.\n\n- CVE-2017-1000254 (denial of service)\n\nWhen libcurl connects to an FTP server and successfully logs in\n(anonymous or not), it asks the server for the current directory with\nthe `PWD` command. The server then responds with a 257 response\ncontaining the path, inside double quotes. The returned path name is\nthen kept by libcurl for subsequent uses. Due to a flaw in the string\nparser for this directory name, a directory name passed like this but\nwithout a closing double quote would lead to libcurl not adding a\ntrailing NUL byte to the buffer holding the name. When libcurl would\nthen later access the string, it could read beyond the allocated heap\nbuffer and crash or wrongly access data beyond the buffer, thinking it\nwas part of the path. A malicious server could abuse this fact and\neffectively prevent libcurl-based clients to work with it - the PWD\ncommand is always issued on new FTP connections and the mistake has a\nhigh chance of causing a segfault.\n\nImpact\n======\n\nAn attacker is able to read sensitive information by asking curl to\nretrieve a maliciously crafted URL. Furthermore a malicious server can\ncause libcurl to segfault when connecting via FTP leading to denial of\nservice.\n\nReferences\n==========\n\nhttps://curl.haxx.se/docs/adv_20170809C.html\nhttps://curl.haxx.se/CVE-2017-1000099.patch\nhttps://curl.haxx.se/docs/adv_20170809B.html\nhttps://curl.haxx.se/CVE-2017-1000100.patch\nhttps://curl.haxx.se/docs/adv_20171004.html\nhttps://curl.haxx.se/CVE-2017-1000254.patch\nhttps://github.com/curl/curl/commit/5ff2c5ff25750aba1a8f64fbcad8e5b891512584\nhttps://security.archlinux.org/CVE-2017-1000099\nhttps://security.archlinux.org/CVE-2017-1000100\nhttps://security.archlinux.org/CVE-2017-1000254", "modified": "2017-10-05T00:00:00", "published": "2017-10-05T00:00:00", "id": "ASA-201710-6", "href": "https://security.archlinux.org/ASA-201710-6", "type": "archlinux", "title": "[ASA-201710-6] lib32-libcurl-compat: multiple issues", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-09-22T18:36:42", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000099", "CVE-2017-1000100", "CVE-2017-1000254"], "description": "Arch Linux Security Advisory ASA-201710-7\n=========================================\n\nSeverity: Medium\nDate : 2017-10-05\nCVE-ID : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000254\nPackage : libcurl-compat\nType : multiple issues\nRemote : Yes\nLink : https://security.archlinux.org/AVG-389\n\nSummary\n=======\n\nThe package libcurl-compat before version 7.56.0-1 is vulnerable to\nmultiple issues including information disclosure and denial of service.\n\nResolution\n==========\n\nUpgrade to 7.56.0-1.\n\n# pacman -Syu \"libcurl-compat>=7.56.0-1\"\n\nThe problems have been fixed upstream in version 7.56.0.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\n- CVE-2017-1000099 (information disclosure)\n\nAn information disclosure issue has been found in curl < 7.55.0. When\nasking to get a file from a file:// URL, libcurl provides a feature\nthat outputs meta-data about the file using HTTP-like headers. The code\ndoing this would send the wrong buffer to the user (stdout or the\napplication's provide callback), which could lead to other private data\nfrom the heap to get inadvertently displayed. The wrong buffer was an\nuninitialized memory area allocated on the heap and if it turned out to\nnot contain any zero byte, it would continue and display the data\nfollowing that buffer in memory.\n\n- CVE-2017-1000100 (information disclosure)\n\nAn information disclosure issue has been found in curl < 7.55.0. When\ndoing a TFTP transfer and curl/libcurl is given a URL that contains a\nvery long file name (longer than about 515 bytes), the file name is\ntruncated to fit within the buffer boundaries, but the buffer size is\nstill wrongly updated to use the untruncated length. This too large\nvalue is then used in the sendto() call, making curl attempt to send\nmore data than what is actually put into the buffer. The sendto()\nfunction will then read beyond the end of the heap based buffer.\nA malicious HTTP(S) server could redirect a vulnerable libcurl-using\nclient to a crafted TFTP URL (if the client hasn't restricted which\nprotocols it allows redirects to) and trick it to send private memory\ncontents to a remote server over UDP.\n\n- CVE-2017-1000254 (denial of service)\n\nWhen libcurl connects to an FTP server and successfully logs in\n(anonymous or not), it asks the server for the current directory with\nthe `PWD` command. The server then responds with a 257 response\ncontaining the path, inside double quotes. The returned path name is\nthen kept by libcurl for subsequent uses. Due to a flaw in the string\nparser for this directory name, a directory name passed like this but\nwithout a closing double quote would lead to libcurl not adding a\ntrailing NUL byte to the buffer holding the name. When libcurl would\nthen later access the string, it could read beyond the allocated heap\nbuffer and crash or wrongly access data beyond the buffer, thinking it\nwas part of the path. A malicious server could abuse this fact and\neffectively prevent libcurl-based clients to work with it - the PWD\ncommand is always issued on new FTP connections and the mistake has a\nhigh chance of causing a segfault.\n\nImpact\n======\n\nAn attacker is able to read sensitive information by asking curl to\nretrieve a maliciously crafted URL. Furthermore a malicious server can\ncause libcurl to segfault when connecting via FTP leading to denial of\nservice.\n\nReferences\n==========\n\nhttps://curl.haxx.se/docs/adv_20170809C.html\nhttps://curl.haxx.se/CVE-2017-1000099.patch\nhttps://curl.haxx.se/docs/adv_20170809B.html\nhttps://curl.haxx.se/CVE-2017-1000100.patch\nhttps://curl.haxx.se/docs/adv_20171004.html\nhttps://curl.haxx.se/CVE-2017-1000254.patch\nhttps://github.com/curl/curl/commit/5ff2c5ff25750aba1a8f64fbcad8e5b891512584\nhttps://security.archlinux.org/CVE-2017-1000099\nhttps://security.archlinux.org/CVE-2017-1000100\nhttps://security.archlinux.org/CVE-2017-1000254", "modified": "2017-10-05T00:00:00", "published": "2017-10-05T00:00:00", "id": "ASA-201710-7", "href": "https://security.archlinux.org/ASA-201710-7", "type": "archlinux", "title": "[ASA-201710-7] libcurl-compat: multiple issues", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-09-22T18:36:42", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000099", "CVE-2017-1000100", "CVE-2017-1000254"], "description": "Arch Linux Security Advisory ASA-201710-3\n=========================================\n\nSeverity: Medium\nDate : 2017-10-05\nCVE-ID : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000254\nPackage : lib32-curl\nType : multiple issues\nRemote : Yes\nLink : https://security.archlinux.org/AVG-371\n\nSummary\n=======\n\nThe package lib32-curl before version 7.56.0-1 is vulnerable to\nmultiple issues including information disclosure and denial of service.\n\nResolution\n==========\n\nUpgrade to 7.56.0-1.\n\n# pacman -Syu \"lib32-curl>=7.56.0-1\"\n\nThe problems have been fixed upstream in version 7.56.0.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\n- CVE-2017-1000099 (information disclosure)\n\nAn information disclosure issue has been found in curl < 7.55.0. When\nasking to get a file from a file:// URL, libcurl provides a feature\nthat outputs meta-data about the file using HTTP-like headers. The code\ndoing this would send the wrong buffer to the user (stdout or the\napplication's provide callback), which could lead to other private data\nfrom the heap to get inadvertently displayed. The wrong buffer was an\nuninitialized memory area allocated on the heap and if it turned out to\nnot contain any zero byte, it would continue and display the data\nfollowing that buffer in memory.\n\n- CVE-2017-1000100 (information disclosure)\n\nAn information disclosure issue has been found in curl < 7.55.0. When\ndoing a TFTP transfer and curl/libcurl is given a URL that contains a\nvery long file name (longer than about 515 bytes), the file name is\ntruncated to fit within the buffer boundaries, but the buffer size is\nstill wrongly updated to use the untruncated length. This too large\nvalue is then used in the sendto() call, making curl attempt to send\nmore data than what is actually put into the buffer. The sendto()\nfunction will then read beyond the end of the heap based buffer.\nA malicious HTTP(S) server could redirect a vulnerable libcurl-using\nclient to a crafted TFTP URL (if the client hasn't restricted which\nprotocols it allows redirects to) and trick it to send private memory\ncontents to a remote server over UDP.\n\n- CVE-2017-1000254 (denial of service)\n\nWhen libcurl connects to an FTP server and successfully logs in\n(anonymous or not), it asks the server for the current directory with\nthe `PWD` command. The server then responds with a 257 response\ncontaining the path, inside double quotes. The returned path name is\nthen kept by libcurl for subsequent uses. Due to a flaw in the string\nparser for this directory name, a directory name passed like this but\nwithout a closing double quote would lead to libcurl not adding a\ntrailing NUL byte to the buffer holding the name. When libcurl would\nthen later access the string, it could read beyond the allocated heap\nbuffer and crash or wrongly access data beyond the buffer, thinking it\nwas part of the path. A malicious server could abuse this fact and\neffectively prevent libcurl-based clients to work with it - the PWD\ncommand is always issued on new FTP connections and the mistake has a\nhigh chance of causing a segfault.\n\nImpact\n======\n\nAn attacker is able to read sensitive information by asking curl to\nretrieve a maliciously crafted URL. Furthermore a malicious server can\ncause libcurl to segfault when connecting via FTP leading to denial of\nservice.\n\nReferences\n==========\n\nhttps://curl.haxx.se/docs/adv_20170809C.html\nhttps://curl.haxx.se/CVE-2017-1000099.patch\nhttps://curl.haxx.se/docs/adv_20170809B.html\nhttps://curl.haxx.se/CVE-2017-1000100.patch\nhttps://curl.haxx.se/docs/adv_20171004.html\nhttps://curl.haxx.se/CVE-2017-1000254.patch\nhttps://github.com/curl/curl/commit/5ff2c5ff25750aba1a8f64fbcad8e5b891512584\nhttps://security.archlinux.org/CVE-2017-1000099\nhttps://security.archlinux.org/CVE-2017-1000100\nhttps://security.archlinux.org/CVE-2017-1000254", "modified": "2017-10-05T00:00:00", "published": "2017-10-05T00:00:00", "id": "ASA-201710-3", "href": "https://security.archlinux.org/ASA-201710-3", "type": "archlinux", "title": "[ASA-201710-3] lib32-curl: multiple issues", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-09-22T18:36:42", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000099", "CVE-2017-1000100", "CVE-2017-1000254"], "description": "Arch Linux Security Advisory ASA-201710-4\n=========================================\n\nSeverity: Medium\nDate : 2017-10-05\nCVE-ID : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000254\nPackage : lib32-libcurl-gnutls\nType : multiple issues\nRemote : Yes\nLink : https://security.archlinux.org/AVG-386\n\nSummary\n=======\n\nThe package lib32-libcurl-gnutls before version 7.56.0-1 is vulnerable\nto multiple issues including information disclosure and denial of\nservice.\n\nResolution\n==========\n\nUpgrade to 7.56.0-1.\n\n# pacman -Syu \"lib32-libcurl-gnutls>=7.56.0-1\"\n\nThe problems have been fixed upstream in version 7.56.0.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\n- CVE-2017-1000099 (information disclosure)\n\nAn information disclosure issue has been found in curl < 7.55.0. When\nasking to get a file from a file:// URL, libcurl provides a feature\nthat outputs meta-data about the file using HTTP-like headers. The code\ndoing this would send the wrong buffer to the user (stdout or the\napplication's provide callback), which could lead to other private data\nfrom the heap to get inadvertently displayed. The wrong buffer was an\nuninitialized memory area allocated on the heap and if it turned out to\nnot contain any zero byte, it would continue and display the data\nfollowing that buffer in memory.\n\n- CVE-2017-1000100 (information disclosure)\n\nAn information disclosure issue has been found in curl < 7.55.0. When\ndoing a TFTP transfer and curl/libcurl is given a URL that contains a\nvery long file name (longer than about 515 bytes), the file name is\ntruncated to fit within the buffer boundaries, but the buffer size is\nstill wrongly updated to use the untruncated length. This too large\nvalue is then used in the sendto() call, making curl attempt to send\nmore data than what is actually put into the buffer. The sendto()\nfunction will then read beyond the end of the heap based buffer.\nA malicious HTTP(S) server could redirect a vulnerable libcurl-using\nclient to a crafted TFTP URL (if the client hasn't restricted which\nprotocols it allows redirects to) and trick it to send private memory\ncontents to a remote server over UDP.\n\n- CVE-2017-1000254 (denial of service)\n\nWhen libcurl connects to an FTP server and successfully logs in\n(anonymous or not), it asks the server for the current directory with\nthe `PWD` command. The server then responds with a 257 response\ncontaining the path, inside double quotes. The returned path name is\nthen kept by libcurl for subsequent uses. Due to a flaw in the string\nparser for this directory name, a directory name passed like this but\nwithout a closing double quote would lead to libcurl not adding a\ntrailing NUL byte to the buffer holding the name. When libcurl would\nthen later access the string, it could read beyond the allocated heap\nbuffer and crash or wrongly access data beyond the buffer, thinking it\nwas part of the path. A malicious server could abuse this fact and\neffectively prevent libcurl-based clients to work with it - the PWD\ncommand is always issued on new FTP connections and the mistake has a\nhigh chance of causing a segfault.\n\nImpact\n======\n\nAn attacker is able to read sensitive information by asking curl to\nretrieve a maliciously crafted URL. Furthermore a malicious server can\ncause libcurl to segfault when connecting via FTP leading to denial of\nservice.\n\nReferences\n==========\n\nhttps://curl.haxx.se/docs/adv_20170809C.html\nhttps://curl.haxx.se/CVE-2017-1000099.patch\nhttps://curl.haxx.se/docs/adv_20170809B.html\nhttps://curl.haxx.se/CVE-2017-1000100.patch\nhttps://curl.haxx.se/docs/adv_20171004.html\nhttps://curl.haxx.se/CVE-2017-1000254.patch\nhttps://github.com/curl/curl/commit/5ff2c5ff25750aba1a8f64fbcad8e5b891512584\nhttps://security.archlinux.org/CVE-2017-1000099\nhttps://security.archlinux.org/CVE-2017-1000100\nhttps://security.archlinux.org/CVE-2017-1000254", "modified": "2017-10-05T00:00:00", "published": "2017-10-05T00:00:00", "id": "ASA-201710-4", "href": "https://security.archlinux.org/ASA-201710-4", "type": "archlinux", "title": "[ASA-201710-4] lib32-libcurl-gnutls: multiple issues", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-09-22T18:36:42", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000099", "CVE-2017-1000100", "CVE-2017-1000254"], "description": "Arch Linux Security Advisory ASA-201710-5\n=========================================\n\nSeverity: Medium\nDate : 2017-10-05\nCVE-ID : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000254\nPackage : libcurl-gnutls\nType : multiple issues\nRemote : Yes\nLink : https://security.archlinux.org/AVG-387\n\nSummary\n=======\n\nThe package libcurl-gnutls before version 7.56.0-1 is vulnerable to\nmultiple issues including information disclosure and denial of service.\n\nResolution\n==========\n\nUpgrade to 7.56.0-1.\n\n# pacman -Syu \"libcurl-gnutls>=7.56.0-1\"\n\nThe problems have been fixed upstream in version 7.56.0.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\n- CVE-2017-1000099 (information disclosure)\n\nAn information disclosure issue has been found in curl < 7.55.0. When\nasking to get a file from a file:// URL, libcurl provides a feature\nthat outputs meta-data about the file using HTTP-like headers. The code\ndoing this would send the wrong buffer to the user (stdout or the\napplication's provide callback), which could lead to other private data\nfrom the heap to get inadvertently displayed. The wrong buffer was an\nuninitialized memory area allocated on the heap and if it turned out to\nnot contain any zero byte, it would continue and display the data\nfollowing that buffer in memory.\n\n- CVE-2017-1000100 (information disclosure)\n\nAn information disclosure issue has been found in curl < 7.55.0. When\ndoing a TFTP transfer and curl/libcurl is given a URL that contains a\nvery long file name (longer than about 515 bytes), the file name is\ntruncated to fit within the buffer boundaries, but the buffer size is\nstill wrongly updated to use the untruncated length. This too large\nvalue is then used in the sendto() call, making curl attempt to send\nmore data than what is actually put into the buffer. The sendto()\nfunction will then read beyond the end of the heap based buffer.\nA malicious HTTP(S) server could redirect a vulnerable libcurl-using\nclient to a crafted TFTP URL (if the client hasn't restricted which\nprotocols it allows redirects to) and trick it to send private memory\ncontents to a remote server over UDP.\n\n- CVE-2017-1000254 (denial of service)\n\nWhen libcurl connects to an FTP server and successfully logs in\n(anonymous or not), it asks the server for the current directory with\nthe `PWD` command. The server then responds with a 257 response\ncontaining the path, inside double quotes. The returned path name is\nthen kept by libcurl for subsequent uses. Due to a flaw in the string\nparser for this directory name, a directory name passed like this but\nwithout a closing double quote would lead to libcurl not adding a\ntrailing NUL byte to the buffer holding the name. When libcurl would\nthen later access the string, it could read beyond the allocated heap\nbuffer and crash or wrongly access data beyond the buffer, thinking it\nwas part of the path. A malicious server could abuse this fact and\neffectively prevent libcurl-based clients to work with it - the PWD\ncommand is always issued on new FTP connections and the mistake has a\nhigh chance of causing a segfault.\n\nImpact\n======\n\nAn attacker is able to read sensitive information by asking curl to\nretrieve a maliciously crafted URL. Furthermore a malicious server can\ncause libcurl to segfault when connecting via FTP leading to denial of\nservice.\n\nReferences\n==========\n\nhttps://curl.haxx.se/docs/adv_20170809C.html\nhttps://curl.haxx.se/CVE-2017-1000099.patch\nhttps://curl.haxx.se/docs/adv_20170809B.html\nhttps://curl.haxx.se/CVE-2017-1000100.patch\nhttps://curl.haxx.se/docs/adv_20171004.html\nhttps://curl.haxx.se/CVE-2017-1000254.patch\nhttps://github.com/curl/curl/commit/5ff2c5ff25750aba1a8f64fbcad8e5b891512584\nhttps://security.archlinux.org/CVE-2017-1000099\nhttps://security.archlinux.org/CVE-2017-1000100\nhttps://security.archlinux.org/CVE-2017-1000254", "modified": "2017-10-05T00:00:00", "published": "2017-10-05T00:00:00", "id": "ASA-201710-5", "href": "https://security.archlinux.org/ASA-201710-5", "type": "archlinux", "title": "[ASA-201710-5] libcurl-gnutls: multiple issues", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-09-22T18:36:42", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000254"], "description": "Arch Linux Security Advisory ASA-201710-2\n=========================================\n\nSeverity: Low\nDate : 2017-10-05\nCVE-ID : CVE-2017-1000254\nPackage : curl\nType : denial of service\nRemote : Yes\nLink : https://security.archlinux.org/AVG-422\n\nSummary\n=======\n\nThe package curl before version 7.56.0-1 is vulnerable to denial of\nservice.\n\nResolution\n==========\n\nUpgrade to 7.56.0-1.\n\n# pacman -Syu \"curl>=7.56.0-1\"\n\nThe problem has been fixed upstream in version 7.56.0.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\nWhen libcurl connects to an FTP server and successfully logs in\n(anonymous or not), it asks the server for the current directory with\nthe `PWD` command. The server then responds with a 257 response\ncontaining the path, inside double quotes. The returned path name is\nthen kept by libcurl for subsequent uses. Due to a flaw in the string\nparser for this directory name, a directory name passed like this but\nwithout a closing double quote would lead to libcurl not adding a\ntrailing NUL byte to the buffer holding the name. When libcurl would\nthen later access the string, it could read beyond the allocated heap\nbuffer and crash or wrongly access data beyond the buffer, thinking it\nwas part of the path. A malicious server could abuse this fact and\neffectively prevent libcurl-based clients to work with it - the PWD\ncommand is always issued on new FTP connections and the mistake has a\nhigh chance of causing a segfault.\n\nImpact\n======\n\nA malicious server can cause libcurl to segfault when connecting via\nFTP leading to denial of service.\n\nReferences\n==========\n\nhttps://curl.haxx.se/docs/adv_20171004.html\nhttps://curl.haxx.se/CVE-2017-1000254.patch\nhttps://github.com/curl/curl/commit/5ff2c5ff25750aba1a8f64fbcad8e5b891512584\nhttps://security.archlinux.org/CVE-2017-1000254", "modified": "2017-10-05T00:00:00", "published": "2017-10-05T00:00:00", "id": "ASA-201710-2", "href": "https://security.archlinux.org/ASA-201710-2", "type": "archlinux", "title": "[ASA-201710-2] curl: denial of service", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "gentoo": [{"lastseen": "2017-09-18T01:53:37", "bulletinFamily": "unix", "cvelist": ["CVE-2017-7407", "CVE-2017-1000101", "CVE-2017-1000099", "CVE-2017-1000100", "CVE-2017-7468"], "description": "### Background\n\ncURL is a tool and libcurl is a library for transferring data with URL syntax. \n\n### Description\n\nMultiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nRemote attackers could cause a Denial of Service condition, obtain sensitive information, or bypass intended restrictions for TLS sessions. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll cURL users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-misc/curl-7.55.1\"", "edition": 1, "modified": "2017-09-17T00:00:00", "published": "2017-09-17T00:00:00", "href": "https://security.gentoo.org/glsa/201709-14", "id": "GLSA-201709-14", "title": "cURL: Multiple vulnerabilities", "type": "gentoo", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2017-12-14T23:35:27", "bulletinFamily": "unix", "cvelist": ["CVE-2017-8817", "CVE-2017-1000254", "CVE-2017-8818", "CVE-2017-8816", "CVE-2017-1000257"], "description": "### Background\n\nA command line tool and library for transferring data with URLs.\n\n### Description\n\nMultiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nRemote attackers could cause a Denial of Service condition, disclose sensitive information or other unspecified impacts. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll cURL users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-misc/curl-7.57.0\"", "edition": 1, "modified": "2017-12-14T00:00:00", "published": "2017-12-14T00:00:00", "href": "https://security.gentoo.org/glsa/201712-04", "id": "GLSA-201712-04", "title": "cURL: Multiple vulnerabilities", "type": "gentoo", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:PARTIAL/"}}], "hackerone": [{"lastseen": "2019-01-30T20:18:34", "bulletinFamily": "bugbounty", "bounty": 0.0, "cvelist": [], "description": "**FYI, this security advisory will not be released until 9 August 2017:**\n```\ncurl supports \"globbing\" of URLs, in which a user can pass a numerical range\nto have the tool iterate over those numbers to do a sequence of transfers.\n\nIn the globbing function that parses the numerical range, there was an\nomission that made curl read a byte beyond the end of the URL if given a\ncarefully crafted, or just wrongly written, URL. The URL is stored in a heap\nbased buffer, so it could then be made to wrongly read something else instead\nof crashing.\n\nAn example of a URL that triggers the flaw would be\n`http://ur%20[0-60000000000000000000`.\n```\n\nReported to project maintainers: 14 June 2017\nAcknowledged: 14 June 2017\nPatched: 14 June 2017\nReleased: 9 August 2017\nAdvisory: 9 August 2017\n\nStack:\n```\ncurl -q http://ur%20[0-60000000000000000000\n\ncurl: (6) Couldn't resolve host 'ur'\n=================================================================\n==16611==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000023de8 at pc 0x0000004f9ecc bp 0x7ffef3e73b50 sp 0x7ffef3e73b48\nREAD of size 1 at 0x603000023de8 thread T0\n #0 0x4f9ecb in glob_range /root/curl/src/tool_urlglob.c:282:12\n #1 0x4f9ecb in glob_parse /root/curl/src/tool_urlglob.c:412\n #2 0x4f9ecb in glob_url /root/curl/src/tool_urlglob.c:450\n #3 0x4e2b37 in operate_do /root/curl/src/tool_operate.c:526:18\n #4 0x4e076e in operate /root/curl/src/tool_operate.c:2052:20\n #5 0x4de7d6 in main /root/curl/src/tool_main.c:252:14\n #6 0x7fa930f74b44 in __libc_start_main /build/glibc-KShDyh/glibc-2.19/csu/libc-start.c:287\n #7 0x4c3f1c in _start (/root/curl/src/curl+0x4c3f1c)\n\n0x603000023de8 is located 0 bytes to the right of 24-byte region [0x603000023dd0,0x603000023de8)\nallocated by thread T0 here:\n #0 0x4a689b in malloc (/root/curl/src/curl+0x4a689b)\n #1 0x7fa930fd4989 in __strdup /build/glibc-KShDyh/glibc-2.19/string/strdup.c:42\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /root/curl/src/tool_urlglob.c:282 glob_range\n```", "modified": "2018-05-16T15:38:16", "published": "2017-08-01T18:13:51", "id": "H1:255587", "href": "https://hackerone.com/reports/255587", "type": "hackerone", "title": "Data Processing (IBB): CVE-2017-1000101: cURL: URL globbing out of bounds read", "cvss": {"score": 0.0, "vector": "NONE"}}], "suse": [{"lastseen": "2017-09-14T22:30:08", "bulletinFamily": "unix", "cvelist": ["CVE-2017-9233", "CVE-2017-10685", "CVE-2016-9063", "CVE-2017-11112", "CVE-2017-8872", "CVE-2017-3456", "CVE-2017-11113", "CVE-2017-7436", "CVE-2017-3309", "CVE-2017-1000101", "CVE-2017-3308", "CVE-2017-3453", "CVE-2017-1000100", "CVE-2017-3464", "CVE-2017-7435", "CVE-2017-10684", "CVE-2013-7459", "CVE-2017-9269"], "description": "The Docker images provided with SUSE CaaS Platform 1.0 have been updated\n to include the following updates:\n\n libzypp:\n\n - CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows,\n mainly for unsigned repositories and packages. (bsc#1045735, bsc#1038984)\n - Fix gpg-pubkey release (creation time) computation. (bsc#1036659)\n - Update lsof blacklist. (bsc#1046417)\n - Re-probe on refresh if the repository type changes. (bsc#1048315)\n - Propagate proper error code to DownloadProgressReport. (bsc#1047785)\n - Allow to trigger an appdata refresh unconditionally. (bsc#1009745)\n - Support custom repo variables defined in /etc/zypp/vars.d.\n - Adapt loop mounting of ISO images. (bsc#1038132, bsc#1033236)\n - Fix potential crash if repository has no baseurl. (bsc#1043218)\n\n zypper:\n\n - CVE-2017-7436: Adapt download callback to report and handle unsigned\n packages. (bsc#1038984)\n - Report missing/optional files as 'not found' rather than 'error'.\n (bsc#1047785)\n - Document support for custom repository variables defined in\n /etc/zypp/vars.d.\n - Emphasize that it depends on how fast PackageKit will respond to a\n 'quit' request sent if PK blocks package management.\n\n libgcrypt:\n\n - Fix infinite loop in gnome-keyring-daemon caused by attempt to read from\n random device left open by libgcrypt. (bsc#1043333)\n - Avoid seeding the DRBG during FIPS power-up selftests. (bsc#1046659)\n - Fix a bug in gcry_drbg_healthcheck_sanity() which caused skipping some\n of the tests. (bsc#1046659)\n - dlsym returns PLT address on s390x, dlopen libgcrypt20.so before calling\n dlsym. (bsc#1047008)\n\n lua51:\n\n - Add Lua(API) and Lua(devel) symbols to fix building of lua51-luasocket.\n (bsc#1051626)\n\n cyrus-sasl:\n\n - Fix unknown authentication mechanism: kerberos5 (bsc#1026825)\n - Really use SASLAUTHD_PARAMS variable (bsc#938657)\n - Make sure /usr/sbin/rcsaslauthd exists\n - Add /usr/sbin/rcsaslauthd symbolic link to /usr/sbin/service\n (bsc#1014471)\n - Silence "GSSAPI client step 1" debug log message (bsc#1044840)\n\n libxml2:\n\n - CVE-2017-8872: Out-of-bounds read in htmlParseTryOrFinish. (bsc#1038444)\n\n curl:\n\n - CVE-2017-1000100: TFP sends more than buffer size and it could lead to a\n denial of service. (bsc#1051644)\n - CVE-2017-1000101: URL globbing out of bounds read could lead to a denial\n of service. (bsc#1051643)\n\n ncurses:\n\n - CVE-2017-11112: Illegal address access in append_acs. (bsc#1047964)\n - CVE-2017-11113: Dereferencing NULL pointer in _nc_parse_entry.\n (bsc#1047965)\n - CVE-2017-10684, CVE-2017-10685: Add modified upstream fix from ncurses\n 6.0 to avoid broken termcap format (bsc#1046853, bsc#1046858,\n bsc#1049344)\n\n sed:\n\n - Don't terminate with a segmentation fault if close of last file\n descriptor fails. (bsc#954661)\n\n openssl:\n\n - Remove DES-CBC3-SHA based ciphers from DEFAULT_SUSE to address SWEET32\n problem. (bsc#1027908)\n - Use getrandom syscall instead of reading from /dev/urandom to get at\n least 128 bits of entropy to comply with FIPS 140.2 IG 7.14.\n (bsc#1027079 bsc#1044175)\n - Fix x86 extended feature detection (bsc#1029523)\n - Allow runtime switching of s390x capabilities via the "OPENSSL_s390xcap"\n environmental variable. (bsc#1028723)\n - Add back certificate initialization set_cert_key_stuff() which was\n removed in a previous update. (bsc#1028281)\n - Fix a bug in XTS key handling. (bsc#1019637)\n - Don't run FIPS power-up self-tests when the checksum files aren't\n installed. (bsc#1042392)\n\n procps:\n\n - Don't set buffering on invalid file descriptor. (bsc#1053409)\n\n expat:\n\n - CVE-2016-9063: Possible integer overflow to fix inside XML_Parse leading\n to unexpected behaviour. (bsc#1047240)\n - CVE-2017-9233: External Entity Vulnerability could lead to denial of\n service. (bsc#1047236)\n\n systemd:\n\n - Revert fix for bsc#1004995 which could have caused boot failure on LVM\n (bsc#1048605)\n - compat-rules: drop the bogus 'import everything' rule (bsc#1046268)\n - core: use an AF_UNIX/SOCK_DGRAM socket for cgroup agent notification\n (bsc#1045384 bsc#1047379)\n - udev/path_id: introduce support for NVMe devices (bsc#1045987)\n - compat-rules: Don't rely on ID_SERIAL when generating 'by-id' links for\n NVMe devices. (bsc#1048679)\n - fstab-generator: Handle NFS "bg" mounts correctly. (bsc#874665,\n fate#323464)\n - timesyncd: Don't use compiled-in list if FallbackNTP has been configured\n explicitly.\n\n insserv-compat:\n\n - Add /etc/init.d hierarchy from former "filesystem" package. (bsc#1035062)\n - Fix directory argument parsing. (bsc#944903)\n - Add perl(Getopt::Long) to list of requirements.\n\n mariadb:\n\n - Update libmysqlclient18 from version 10.0.30 to 10.0.31.\n\n python-pycrypto:\n\n - CVE-2013-7459: Fixed a potential heap buffer overflow in ALGnew\n (bsc#1017420).\n\n velum:\n\n - Fix loopback IP for proxy exception during initial configuration.\n (bsc#1052759)\n - Set secure flag in cookie. (bsc#1050484)\n - Set VERSION to 1.0.0. (bsc#1050396)\n - Allow kubeconfig download when master is ready. (bsc#1048483)\n\n", "edition": 1, "modified": "2017-09-14T21:11:54", "published": "2017-09-14T21:11:54", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-09/msg00047.html", "id": "SUSE-SU-2017:2470-1", "title": "Security update for CaaS Platform 1.0 images (important)", "type": "suse", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-10-11T05:54:20", "bulletinFamily": "unix", "cvelist": ["CVE-2017-7407", "CVE-2017-9233", "CVE-2016-9840", "CVE-2017-7375", "CVE-2017-10685", "CVE-2017-9445", "CVE-2016-9063", "CVE-2016-5300", "CVE-2017-11112", "CVE-2017-5969", "CVE-2016-9318", "CVE-2016-7055", "CVE-2017-3731", "CVE-2017-9049", "CVE-2016-9842", "CVE-2017-2616", "CVE-2017-8872", "CVE-2012-6702", "CVE-2015-3238", "CVE-2017-9048", "CVE-2017-11113", "CVE-2017-3732", "CVE-2017-7376", "CVE-2017-7436", "CVE-2017-1000101", "CVE-2016-9401", "CVE-2017-7526", "CVE-2017-1000366", "CVE-2016-1839", "CVE-2017-0663", "CVE-2016-9843", "CVE-2017-9047", "CVE-2016-9597", "CVE-2017-9217", "CVE-2016-10156", "CVE-2017-1000100", "CVE-2016-9586", "CVE-2016-5011", "CVE-2017-7435", "CVE-2016-9841", "CVE-2016-2037", "CVE-2017-9287", "CVE-2017-6507", "CVE-2016-4658", "CVE-2017-10684", "CVE-2017-9269", "CVE-2017-9050"], "description": "The SUSE Linux Enterprise Server 12 SP2 container image has been updated\n to include security and stability fixes.\n\n The following issues related to building of the container images have been\n fixed:\n\n - Included krb5 package to avoid the inclusion of krb5-mini which gets\n selected as a dependency by the Build Service solver. (bsc#1056193)\n\n A number of security issues that have been already fixed by updates\n released for SUSE Linux Enterprise Server 12 are now included in the base\n image. A package/CVE cross-reference is available below.\n\n bash:\n\n - CVE-2016-9401\n\n expat:\n\n - CVE-2012-6702\n - CVE-2016-5300\n - CVE-2016-9063\n - CVE-2017-9233\n\n curl:\n\n - CVE-2016-9586\n - CVE-2017-1000100\n - CVE-2017-1000101\n - CVE-2017-7407\n\n glibc:\n\n - CVE-2017-1000366\n\n openssl:\n\n - CVE-2017-3731\n - CVE-2017-3732\n - CVE-2016-7055\n\n pam:\n\n - CVE-2015-3238\n\n apparmor:\n\n - CVE-2017-6507\n\n ncurses:\n\n - CVE-2017-10684\n - CVE-2017-10685\n - CVE-2017-11112\n - CVE-2017-11113\n\n libgcrypt:\n\n - CVE-2017-7526\n\n libxml2:\n\n - CVE-2016-1839\n - CVE-2016-4658\n - CVE-2016-9318\n - CVE-2016-9597\n - CVE-2017-0663\n - CVE-2017-5969\n - CVE-2017-7375\n - CVE-2017-7376\n - CVE-2017-8872\n - CVE-2017-9047\n - CVE-2017-9048\n - CVE-2017-9049\n - CVE-2017-9050\n\n libzypp:\n\n - CVE-2017-9269\n - CVE-2017-7435\n - CVE-2017-7436\n\n openldap2:\n\n - CVE-2017-9287\n\n systemd:\n\n - CVE-2016-10156\n - CVE-2017-9217\n - CVE-2017-9445\n\n util-linux:\n\n - CVE-2016-5011\n - CVE-2017-2616\n\n zlib:\n\n - CVE-2016-9840\n - CVE-2016-9841\n - CVE-2016-9842\n - CVE-2016-9843\n\n zypper:\n\n - CVE-2017-7436\n\n Finally, the following packages received non-security fixes:\n\n - binutils\n - cpio\n - cryptsetup\n - cyrus-sasl\n - dbus-1\n - dirmngr\n - e2fsprogs\n - gpg2\n - insserv-compat\n - kmod\n - libsolv\n - libsemanage\n - lvm2\n - lua51\n - netcfg\n - procps\n - sed\n - sg3_utils\n - shadow\n\n", "edition": 1, "modified": "2017-10-11T03:08:09", "published": "2017-10-11T03:08:09", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00012.html", "id": "SUSE-SU-2017:2701-1", "title": "Security update for SLES 12-SP2 Docker image (important)", "type": "suse", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "redhat": [{"lastseen": "2019-08-13T18:46:44", "bulletinFamily": "unix", "cvelist": ["CVE-2016-5419", "CVE-2016-5420", "CVE-2016-5421", "CVE-2016-7141", "CVE-2016-7167", "CVE-2016-8615", "CVE-2016-8616", "CVE-2016-8617", "CVE-2016-8618", "CVE-2016-8619", "CVE-2016-8620", "CVE-2016-8621", "CVE-2016-8622", "CVE-2016-8623", "CVE-2016-8624", "CVE-2016-8625", "CVE-2016-9586", "CVE-2017-1000100", "CVE-2017-1000101", "CVE-2017-1000254", "CVE-2017-1000257", "CVE-2017-15710", "CVE-2017-15715", "CVE-2017-7407", "CVE-2017-8816", "CVE-2017-8817", "CVE-2018-1000007", "CVE-2018-1000120", "CVE-2018-1000121", "CVE-2018-1000122", "CVE-2018-1000301", "CVE-2018-11763", "CVE-2018-1283", "CVE-2018-1301", "CVE-2018-1303", "CVE-2018-1312", "CVE-2018-1333", "CVE-2018-14618"], "description": "The Apache HTTP Server is a powerful, efficient, and extensible web server. The httpd24 packages provide a recent stable release of version 2.4 of the Apache HTTP Server, along with the mod_auth_kerb module.\n\nThe following packages have been upgraded to a later upstream version: httpd24-httpd (2.4.34), httpd24-curl (7.61.1). (BZ#1590833, BZ#1648928)\n\nSecurity Fix(es):\n\n* httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI applications (CVE-2018-1283)\n\n* httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)\n\n* httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)\n\n* httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)\n\n* httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values (CVE-2017-15710)\n\n* httpd: <FilesMatch> bypass with a trailing newline in the file name (CVE-2017-15715)\n\n* httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)\n\n* httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)\n\n* curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421, CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619, CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586, CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816, CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301, CVE-2018-14618)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank the Curl project for reporting CVE-2017-8816, CVE-2017-8817, CVE-2017-1000254, CVE-2017-1000257, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000122, CVE-2018-1000301, CVE-2016-9586, CVE-2017-1000100, CVE-2017-1000101, CVE-2018-14618, and CVE-2018-1000121. Upstream acknowledges Alex Nichols as the original reporter of CVE-2017-8816; the OSS-Fuzz project as the original reporter of CVE-2017-8817 and CVE-2018-1000301; Max Dymond as the original reporter of CVE-2017-1000254 and CVE-2018-1000122; Brian Carpenter and the OSS-Fuzz project as the original reporters of CVE-2017-1000257; Craig de Stigter as the original reporter of CVE-2018-1000007; Duy Phan Thanh as the original reporter of CVE-2018-1000120; Even Rouault as the original reporter of CVE-2017-1000100; Brian Carpenter as the original reporter of CVE-2017-1000101; Zhaoyang Wu as the original reporter of CVE-2018-14618; and Dario Weisser as the original reporter of CVE-2018-1000121.\n\nBug Fix(es):\n\n* Previously, the Apache HTTP Server from the httpd24 Software Collection was unable to handle situations when static content was repeatedly requested in a browser by refreshing the page. As a consequence, HTTP/2 connections timed out and httpd became unresponsive. This bug has been fixed, and HTTP/2 connections now work as expected in the described scenario. (BZ#1518737)\n\nEnhancement(s):\n\n* This update adds the mod_md module to the httpd24 Software Collection. This module enables managing domains across virtual hosts and certificate provisioning using the Automatic Certificate Management Environment (ACME) protocol. The mod_md module is available only for Red Hat Enterprise Linux 7. (BZ#1640722)\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Software Collections 3.2 Release Notes linked from the References section.", "modified": "2018-11-13T13:04:35", "published": "2018-11-13T13:00:33", "id": "RHSA-2018:3558", "href": "https://access.redhat.com/errata/RHSA-2018:3558", "type": "redhat", "title": "(RHSA-2018:3558) Moderate: httpd24 security, bug fix, and enhancement update", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-11T13:30:43", "bulletinFamily": "unix", "cvelist": ["CVE-2016-0718", "CVE-2016-4483", "CVE-2016-4975", "CVE-2016-5131", "CVE-2016-7167", "CVE-2016-8615", "CVE-2016-8616", "CVE-2016-8617", "CVE-2016-8618", "CVE-2016-8619", "CVE-2016-8621", "CVE-2016-8622", "CVE-2016-8623", "CVE-2016-8624", "CVE-2016-8625", "CVE-2016-9318", "CVE-2016-9596", "CVE-2016-9597", "CVE-2016-9598", "CVE-2017-1000254", "CVE-2017-1000257", "CVE-2017-18258", "CVE-2017-6004", "CVE-2017-7186", "CVE-2017-7244", "CVE-2017-7245", "CVE-2017-7246", "CVE-2017-9047", "CVE-2017-9048", "CVE-2017-9049", "CVE-2017-9050", "CVE-2018-0500"], "description": "This release adds the new Apache HTTP Server 2.4.29 packages that are part\nof the JBoss Core Services offering.\n\nThis release serves as a replacement for Red Hat JBoss Core Services\nApache HTTP Server 2.4.23, and includes bug fixes and enhancements. Refer\nto the Release Notes for information on the most significant bug fixes,\nenhancements and component upgrades included in this release.\n\nSecurity Fix(es):\n\n* expat: Out-of-bounds heap read on crafted input causing crash (CVE-2016-0718)\n* curl: escape and unescape integer overflows (CVE-2016-7167)\n* curl: Cookie injection for other servers (CVE-2016-8615)\n* curl: Case insensitive password comparison (CVE-2016-8616)\n* curl: Out-of-bounds write via unchecked multiplication (CVE-2016-8617)\n* curl: Double-free in curl_maprintf (CVE-2016-8618)\n* curl: Double-free in krb5 code (CVE-2016-8619)\n* curl: curl_getdate out-of-bounds read (CVE-2016-8621)\n* curl: URL unescape heap overflow via integer truncation (CVE-2016-8622)\n* curl: Use-after-free via shared cookies (CVE-2016-8623)\n* curl: Invalid URL parsing with '#' (CVE-2016-8624)\n* curl: IDNA 2003 makes curl use wrong host (CVE-2016-8625)\n* libxml2: out-of-bounds read (unfixed CVE-2016-4483 in JBCS) (CVE-2016-9598)\n* pcre: Out-of-bounds read in compile_bracket_matchingpath function (8.41/3) (CVE-2017-6004)\n* pcre: Invalid Unicode property lookup (8.41/7, 10.24/2) (CVE-2017-7186)\n* pcre: invalid memory read in_pcre32_xclass (pcre_xclass.c) (CVE-2017-7244)\n* pcre: stack-based buffer overflow write in pcre32_copy_substring (CVE-2017-7245)\n* pcre: stack-based buffer overflow write in pcre32_copy_substring (CVE-2017-7246)\n* curl: FTP PWD response parser out of bounds read (CVE-2017-1000254)\n* curl: IMAP FETCH response out of bounds read (CVE-2017-1000257)\n* curl: Heap-based buffer overflow in Curl_smtp_escape_eob() when uploading data over SMTP (CVE-2018-0500)\n\nDetails around this issue, including information about the CVE, severity of\nthe issue, and the CVSS score can be found on the CVE page listed in the\nReference section below.\n\nThe following packages have been upgraded to a newer upstream version:\n* Curl (7.57.0)\n* OpenSSL (1.0.2n)\n* Expat (2.2.5)\n* PCRE (8.41)\n* libxml2 (2.9.7)\n\nAcknowledgements:\n\nCVE-2017-1000254: Red Hat would like to thank Daniel Stenberg for reporting this issue.\nUpstream acknowledges Max Dymond as the original reporter.\nCVE-2017-1000257: Red Hat would like to thank the Curl project for reporting this issue. Upstream acknowledges Brian Carpenter, (the OSS-Fuzz project) as the original reporter.\nCVE-2018-0500: Red Hat would like to thank the Curl project for reporting this issue.", "modified": "2018-09-05T09:26:14", "published": "2018-08-16T20:05:21", "id": "RHSA-2018:2486", "href": "https://access.redhat.com/errata/RHSA-2018:2486", "type": "redhat", "title": "(RHSA-2018:2486) Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 security update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "apple": [{"lastseen": "2020-12-24T20:41:48", "bulletinFamily": "software", "cvelist": ["CVE-2017-12837", "CVE-2017-9798", "CVE-2017-13869", "CVE-2017-5754", "CVE-2017-13887", "CVE-2017-7155", "CVE-2017-13871", "CVE-2017-7151", "CVE-2017-13865", "CVE-2017-13860", "CVE-2017-7158", "CVE-2017-13892", "CVE-2017-3735", "CVE-2017-7172", "CVE-2017-13858", "CVE-2017-13886", "CVE-2017-13904", "CVE-2017-13878", "CVE-2017-7171", "CVE-2017-13855", "CVE-2017-7162", "CVE-2017-13876", "CVE-2017-1000254", "CVE-2017-7159", "CVE-2017-13911", "CVE-2017-15422", "CVE-2017-13868", "CVE-2017-13847", "CVE-2017-13867", "CVE-2017-7163", "CVE-2017-7173", "CVE-2017-13872", "CVE-2017-13883", "CVE-2017-7154", "CVE-2017-13905", "CVE-2017-13848", "CVE-2017-13862", "CVE-2017-13875"], "description": "## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page. You can encrypt communications with Apple using the [Apple Product Security PGP Key](<https://support.apple.com/kb/HT201601>).\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\n\n\n## macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan\n\nReleased December 6, 2017\n\n**APFS**\n\nAvailable for: macOS High Sierra 10.13.1\n\nImpact: APFS encryption keys may not be securely deleted after hibernating\n\nDescription: A logic issue existed in APFS when deleting keys during hibernation. This was addressed with improved state management.\n\nCVE-2017-13887: David Ryskalczyk\n\nEntry added June 21, 2018\n\n**apache**\n\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1\n\nImpact: Processing a maliciously crafted Apache configuration directive may result in the disclosure of process memory\n\nDescription: Multiple issues were addressed by updating to version 2.4.28.\n\nCVE-2017-9798: Hanno B\u00f6ck\n\nEntry updated December 18, 2018\n\n**Auto Unlock**\n\nAvailable for: macOS High Sierra 10.13.1\n\nImpact: An application may be able to gain elevated privileges\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2017-13905: Samuel Gro\u00df (@5aelo)\n\nEntry added October 18, 2018\n\n**CFNetwork Session**\n\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7172: Richard Zhu (fluorescence) working with Trend Micro's Zero Day Initiative\n\nEntry added January 22, 2018\n\n**Contacts**\n\nAvailable for: macOS High Sierra 10.13.1\n\nImpact: Sharing contact information may lead to unexpected data sharing\n\nDescription: An issue existed in the handling of Contact sharing. This issue was addressed with improved handling of user information. \n\nCVE-2017-13892: Ryan Manly of Glenbrook High School District 225\n\nEntry added October 18, 2018\n\n**CoreAnimation**\n\nAvailable for: macOS High Sierra 10.13.1\n\nImpact: An application may be able to execute arbitrary code with elevated privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7171: 360 Security working with Trend Micro's Zero Day Initiative, and Tencent Keen Security Lab (@keen_lab) working with Trend Micro's Zero Day Initiative\n\nEntry added January 22, 2018\n\n**CoreFoundation**\n\nAvailable for: macOS High Sierra 10.13.1\n\nImpact: An application may be able to gain elevated privileges\n\nDescription: A race condition was addressed with additional validation.\n\nCVE-2017-7151: Samuel Gro\u00df (@5aelo)\n\nEntry added October 18, 2018\n\n**curl**\n\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1\n\nImpact: Malicious FTP servers may be able to cause the client to read out-of-bounds memory\n\nDescription: An out-of-bounds read issue existed in the FTP PWD response parsing. This issue was addressed with improved bounds checking.\n\nCVE-2017-1000254: Max Dymond\n\n**Directory Utility**\n\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.1\n\nNot impacted: macOS Sierra 10.12.6 and earlier \n\nImpact: An attacker may be able to bypass administrator authentication without supplying the administrator\u2019s password\n\nDescription: A logic error existed in the validation of credentials. This was addressed with improved credential validation.\n\nCVE-2017-13872\n\n**ICU**\n\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1\n\nImpact: An application may be able to read restricted memory\n\nDescription: An integer overflow was addressed through improved input validation.\n\nCVE-2017-15422: Yuan Deng of Ant-financial Light-Year Security Lab\n\nEntry added March 14, 2018\n\n**Intel Graphics Driver**\n\nAvailable for: macOS High Sierra 10.13.1\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-13883: Yu Wang of Didi Research America\n\nCVE-2017-7163: Yu Wang of Didi Research America\n\nCVE-2017-7155: Yu Wang of Didi Research America\n\nEntry updated December 21, 2017 \n\n**Intel Graphics Driver**\n\nAvailable for: macOS High Sierra 10.13.1\n\nImpact: A local user may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation.\n\nCVE-2017-13878: Ian Beer of Google Project Zero\n\n**Intel Graphics Driver**\n\nAvailable for: macOS High Sierra 10.13.1\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: An out-of-bounds read was addressed through improved bounds checking.\n\nCVE-2017-13875: Ian Beer of Google Project Zero\n\n**IOAcceleratorFamily**\n\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7159: found by IMF developed by HyungSeok Han (daramg.gift) of SoftSec, KAIST (softsec.kaist.ac.kr)\n\nEntry updated December 21, 2017 \n\n**IOKit**\n\nAvailable for: macOS High Sierra 10.13.1\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: An input validation issue existed in the kernel. This issue was addressed through improved input validation.\n\nCVE-2017-13848: Alex Plaskett of MWR InfoSecurity\n\nCVE-2017-13858: an anonymous researcher\n\n**IOKit**\n\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: Multiple memory corruption issues were addressed through improved state management.\n\nCVE-2017-13847: Ian Beer of Google Project Zero\n\n**IOKit**\n\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7162: Tencent Keen Security Lab (@keen_lab) working with Trend Micro's Zero Day Initiative\n\nEntry updated January 10, 2018\n\n**Kernel**\n\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-13904: Kevin Backhouse of Semmle Ltd.\n\nEntry added February 14, 2018\n\n**Kernel**\n\nAvailable for: macOS High Sierra 10.13.1\n\nImpact: An application may be able to read kernel memory (Meltdown)\n\nDescription: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.\n\nCVE-2017-5754: Jann Horn of Google Project Zero; Moritz Lipp of Graz University of Technology; Michael Schwarz of Graz University of Technology; Daniel Gruss of Graz University of Technology; Thomas Prescher of Cyberus Technology GmbH; Werner Haas of Cyberus Technology GmbH; Stefan Mangard of Graz University of Technology; Paul Kocher; Daniel Genkin of University of Pennsylvania and University of Maryland; Yuval Yarom of University of Adelaide and Data61; and Mike Hamburg of Rambus (Cryptography Research Division)\n\nEntry updated January 5, 2018\n\n**Kernel**\n\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-13862: Apple\n\nCVE-2017-13867: Ian Beer of Google Project Zero\n\nEntry updated December 21, 2017 \n\n**Kernel**\n\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1\n\nImpact: An application may be able to read restricted memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2017-7173: Brandon Azad\n\nEntry updated January 11, 2018\n\n**Kernel**\n\nAvailable for: macOS High Sierra 10.13.1\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-13876: Ian Beer of Google Project Zero\n\n**Kernel**\n\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1\n\nImpact: An application may be able to read restricted memory\n\nDescription: A type confusion issue was addressed with improved memory handling.\n\nCVE-2017-13855: Jann Horn of Google Project Zero\n\n**Kernel**\n\nAvailable for: macOS High Sierra 10.13.1\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2017-13865: Ian Beer of Google Project Zero\n\n**Kernel**\n\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2017-13868: Brandon Azad\n\nCVE-2017-13869: Jann Horn of Google Project Zero\n\n**Kernel**\n\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1\n\nImpact: A local user may be able to cause unexpected system termination or read kernel memory\n\nDescription: An input validation issue existed in the kernel. This issue was addressed through improved input validation.\n\nCVE-2017-7154: Jann Horn of Google Project Zero\n\nEntry added December 21, 2017\n\n**Mail**\n\nAvailable for: macOS High Sierra 10.13.1\n\nImpact: A S/MIME encrypted email may be inadvertently sent unencrypted if the receiver's S/MIME certificate is not installed\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-13871: Lukas Pitschl of GPGTools\n\nEntry updated December 21, 2017\n\n**Mail Drafts**\n\nAvailable for: macOS High Sierra 10.13.1\n\nImpact: An attacker with a privileged network position may be able to intercept mail\n\nDescription: An encryption issue existed with S/MIME credentials. The issue was addressed with additional checks and user control.\n\nCVE-2017-13860: Michael Weishaar of INNEO Solutions GmbH\n\nEntry updated January 10, 2018\n\n**OpenSSL**\n\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1\n\nImpact: An application may be able to read restricted memory\n\nDescription: An out-of-bounds read issue existed in X.509 IPAddressFamily parsing. This issue was addressed with improved bounds checking.\n\nCVE-2017-3735: found by OSS-Fuzz\n\n**Perl**\n\nAvailable for: macOS Sierra 10.12.6\n\nImpact: This bugs can allow remote attackers to cause a denial of service\n\nDescription: Public CVE-2017-12837 was addressed by updating the function in Perl 5.18\n\nCVE-2017-12837: Jakub Wilk\n\nEntry added October 18, 2018\n\n**Screen Sharing Server**\n\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.1\n\nImpact: A user with screen sharing access may be able to access any file readable by root\n\nDescription: A permissions issue existed in the handling of screen sharing sessions. This issue was addressed with improved permissions handling.\n\nCVE-2017-7158: Trevor Jacques of Toronto\n\nEntry updated December 21, 2017\n\n**SIP**\n\nAvailable for: macOS High Sierra 10.13.1\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A configuration issue was addressed with additional restrictions.\n\nCVE-2017-13911: Timothy Perfitt of Twocanoes Software\n\nEntry updated August 8, 2018, updated September 25, 2018\n\n**Wi-Fi**\n\nAvailable for: macOS High Sierra 10.13.1\n\nImpact: An unprivileged user may change Wi-Fi system parameters leading to denial of service\n\nDescription: An access issue existed with privileged Wi-Fi system configuration. This issue was addressed with additional restrictions.\n\nCVE-2017-13886: David Kreitschmann and Matthias Schulz of Secure Mobile Networking Lab at TU Darmstadt\n\nEntry added May 2, 2018\n\n\n\n## Additional recognition\n\n**Mail**\n\nWe would like to acknowledge Jon Bottarini of HackerOne for their assistance.\n\nEntry added February 6, 2020\n", "edition": 3, "modified": "2020-07-27T08:21:38", "published": "2020-07-27T08:21:38", "id": "APPLE:HT208331", "href": "https://support.apple.com/kb/HT208331", "title": "About the security content of macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan - Apple Support", "type": "apple", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}]}