ID OPENVAS:881758 Type openvas Reporter Copyright (c) 2013 Greenbone Networks GmbH Modified 2018-01-17T00:00:00
Description
Check for the Version of curl
###############################################################################
# OpenVAS Vulnerability Test
#
# CentOS Update for curl CESA-2013:0983 centos6
#
# Authors:
# System Generated Check
#
# Copyright:
# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2
# (or any later version), as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
###############################################################################
include("revisions-lib.inc");
tag_insight = "cURL provides the libcurl library and a command line tool for downloading
files from servers using various protocols, including HTTP, FTP, and LDAP.
A heap-based buffer overflow flaw was found in the way libcurl unescaped
URLs. A remote attacker could provide a specially-crafted URL that, when
processed by an application using libcurl that handles untrusted URLs,
would possibly cause it to crash or, potentially, execute arbitrary code.
(CVE-2013-2174)
Red Hat would like to thank the cURL project for reporting this issue.
Upstream acknowledges Timo Sirainen as the original reporter.
Users of curl should upgrade to these updated packages, which contain a
backported patch to correct this issue. All running applications using
libcurl must be restarted for the update to take effect.";
tag_affected = "curl on CentOS 6";
tag_solution = "Please Install the Updated Packages.";
if(description)
{
script_id(881758);
script_version("$Revision: 8448 $");
script_tag(name:"last_modification", value:"$Date: 2018-01-17 17:18:06 +0100 (Wed, 17 Jan 2018) $");
script_tag(name:"creation_date", value:"2013-06-27 09:59:47 +0530 (Thu, 27 Jun 2013)");
script_cve_id("CVE-2013-2174");
script_tag(name:"cvss_base", value:"6.8");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:P/I:P/A:P");
script_name("CentOS Update for curl CESA-2013:0983 centos6 ");
script_xref(name: "CESA", value: "2013:0983");
script_xref(name: "URL" , value: "http://lists.centos.org/pipermail/centos-announce/2013-June/019810.html");
script_tag(name: "summary" , value: "Check for the Version of curl");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (c) 2013 Greenbone Networks GmbH");
script_family("CentOS Local Security Checks");
script_dependencies("gather-package-list.nasl");
script_mandatory_keys("ssh/login/centos", "ssh/login/rpms");
script_tag(name : "affected" , value : tag_affected);
script_tag(name : "solution" , value : tag_solution);
script_tag(name : "insight" , value : tag_insight);
script_tag(name:"qod_type", value:"package");
script_tag(name:"solution_type", value:"VendorFix");
exit(0);
}
include("pkg-lib-rpm.inc");
release = get_kb_item("ssh/login/release");
res = "";
if(release == NULL){
exit(0);
}
if(release == "CentOS6")
{
if ((res = isrpmvuln(pkg:"curl", rpm:"curl~7.19.7~37.el6_4", rls:"CentOS6")) != NULL)
{
security_message(data:res);
exit(0);
}
if ((res = isrpmvuln(pkg:"libcurl", rpm:"libcurl~7.19.7~37.el6_4", rls:"CentOS6")) != NULL)
{
security_message(data:res);
exit(0);
}
if ((res = isrpmvuln(pkg:"libcurl-devel", rpm:"libcurl-devel~7.19.7~37.el6_4", rls:"CentOS6")) != NULL)
{
security_message(data:res);
exit(0);
}
if (__pkg_match) exit(99); # Not vulnerable.
exit(0);
}
{"bulletinFamily": "scanner", "viewCount": 0, "naslFamily": "CentOS Local Security Checks", "reporter": "Copyright (c) 2013 Greenbone Networks GmbH", "references": ["2013:0983", "http://lists.centos.org/pipermail/centos-announce/2013-June/019810.html"], "description": "Check for the Version of curl", "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cvelist", "hash": "3712918409a168b3fcabf4a6a30693bf"}, {"key": "cvss", "hash": "737e2591b537c46d1ca7ce6f0cea5cb9"}, {"key": "description", "hash": "7471ec008a9c6fd70645b570c8e4606c"}, {"key": "href", "hash": "d43962b5af99fcb68bef8407c8e89042"}, {"key": "modified", "hash": "ee0b2a19da285757f5b5bf6dc5d373c7"}, {"key": "naslFamily", "hash": "8f8213e8b86855939d5beea715ce3045"}, {"key": "pluginID", "hash": "e1412fee7c5475d2112f59af15edef07"}, {"key": "published", "hash": "adaf791ca2f1e86d4ceb1cda34a13a7c"}, {"key": "references", "hash": "46a5c4c9ee37a6e86faf4b55b29da82c"}, {"key": "reporter", "hash": "1a99a5f9a50e5bac3b749d8558d5e46b"}, {"key": "sourceData", "hash": "a45fdafd6348e09a0c38c9400081afba"}, {"key": "title", "hash": "0677bdeeacbc4a47107ff781b7f6cc04"}, {"key": "type", "hash": "47c1f692ea47a21f716dad07043ade01"}], "href": "http://plugins.openvas.org/nasl.php?oid=881758", "modified": "2018-01-17T00:00:00", "objectVersion": "1.3", "enchantments": {"vulnersScore": 7.5}, "id": "OPENVAS:881758", "title": "CentOS Update for curl CESA-2013:0983 centos6 ", "hash": "57d51c1b7ab8486c65be52c1b67270e57aa9b6b783306660c44c0e6ba82147d9", "edition": 3, "published": "2013-06-27T00:00:00", "type": "openvas", "history": [{"lastseen": "2017-07-02T21:11:10", "bulletin": {"hash": "c27808b21d605f317d753ff51e7d11a6e9727252390c344fa37c902f15a2c328", "viewCount": 0, "reporter": "Copyright (c) 2013 Greenbone Networks GmbH", "references": ["2013:0983", "http://lists.centos.org/pipermail/centos-announce/2013-June/019810.html"], "description": "Check for the Version of curl", "hashmap": [{"key": "cvelist", "hash": "3712918409a168b3fcabf4a6a30693bf"}, {"key": "href", "hash": "d43962b5af99fcb68bef8407c8e89042"}, {"key": "references", "hash": "46a5c4c9ee37a6e86faf4b55b29da82c"}, {"key": "pluginID", "hash": "e1412fee7c5475d2112f59af15edef07"}, {"key": "naslFamily", "hash": "8f8213e8b86855939d5beea715ce3045"}, {"key": "title", "hash": "0677bdeeacbc4a47107ff781b7f6cc04"}, {"key": "sourceData", "hash": "8025a858e7fd0ba69242be4e334b632d"}, {"key": "reporter", "hash": "1a99a5f9a50e5bac3b749d8558d5e46b"}, {"key": "modified", "hash": "e29ab3248acfd6527d1025d945e184c6"}, {"key": "description", "hash": "7471ec008a9c6fd70645b570c8e4606c"}, {"key": "published", "hash": "adaf791ca2f1e86d4ceb1cda34a13a7c"}, {"key": "type", "hash": "47c1f692ea47a21f716dad07043ade01"}, {"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cvss", "hash": "737e2591b537c46d1ca7ce6f0cea5cb9"}], "naslFamily": "CentOS Local Security Checks", "modified": "2016-03-16T00:00:00", "objectVersion": "1.3", "href": "http://plugins.openvas.org/nasl.php?oid=881758", "published": "2013-06-27T00:00:00", "enchantments": {}, "id": "OPENVAS:881758", "title": "CentOS Update for curl CESA-2013:0983 centos6 ", "bulletinFamily": "scanner", "edition": 1, "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for curl CESA-2013:0983 centos6\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"cURL provides the libcurl library and a command line tool for downloading\n files from servers using various protocols, including HTTP, FTP, and LDAP.\n\n A heap-based buffer overflow flaw was found in the way libcurl unescaped\n URLs. A remote attacker could provide a specially-crafted URL that, when\n processed by an application using libcurl that handles untrusted URLs,\n would possibly cause it to crash or, potentially, execute arbitrary code.\n (CVE-2013-2174)\n\n Red Hat would like to thank the cURL project for reporting this issue.\n Upstream acknowledges Timo Sirainen as the original reporter.\n\n Users of curl should upgrade to these updated packages, which contain a\n backported patch to correct this issue. All running applications using\n libcurl must be restarted for the update to take effect.\";\n\n\ntag_affected = \"curl on CentOS 6\";\ntag_solution = \"Please Install the Updated Packages.\";\n\nif(description)\n{\n script_id(881758);\n script_version(\"$Revision: 2868 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-03-16 12:15:11 +0100 (Wed, 16 Mar 2016) $\");\n script_tag(name:\"creation_date\", value:\"2013-06-27 09:59:47 +0530 (Thu, 27 Jun 2013)\");\n script_cve_id(\"CVE-2013-2174\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_name(\"CentOS Update for curl CESA-2013:0983 centos6 \");\n\n script_xref(name: \"CESA\", value: \"2013:0983\");\n script_xref(name: \"URL\" , value: \"http://lists.centos.org/pipermail/centos-announce/2013-June/019810.html\");\n script_summary(\"Check for the Version of curl\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"HostDetails/OS/cpe:/o:centos:centos\", \"login/SSH/success\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"CentOS6\")\n{\n\n if ((res = isrpmvuln(pkg:\"curl\", rpm:\"curl~7.19.7~37.el6_4\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libcurl\", rpm:\"libcurl~7.19.7~37.el6_4\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libcurl-devel\", rpm:\"libcurl-devel~7.19.7~37.el6_4\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "type": "openvas", "history": [], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "cvelist": ["CVE-2013-2174"], "lastseen": "2017-07-02T21:11:10", "pluginID": "881758"}, "differentElements": ["modified", "sourceData"], "edition": 1}, {"lastseen": "2017-07-25T10:51:48", "bulletin": {"hash": "8298edebb09f64b7e0293b4b9b5d08777acbc73bbd09a9a7adc476ba5b48cbfc", "viewCount": 0, "reporter": "Copyright (c) 2013 Greenbone Networks GmbH", "references": ["2013:0983", "http://lists.centos.org/pipermail/centos-announce/2013-June/019810.html"], "description": "Check for the Version of curl", "hashmap": [{"key": "cvelist", "hash": "3712918409a168b3fcabf4a6a30693bf"}, {"key": "href", "hash": "d43962b5af99fcb68bef8407c8e89042"}, {"key": "references", "hash": "46a5c4c9ee37a6e86faf4b55b29da82c"}, {"key": "sourceData", "hash": "6145f3d21c313bfc4f7150dc2a410a53"}, {"key": "pluginID", "hash": "e1412fee7c5475d2112f59af15edef07"}, {"key": "naslFamily", "hash": "8f8213e8b86855939d5beea715ce3045"}, {"key": "title", "hash": "0677bdeeacbc4a47107ff781b7f6cc04"}, {"key": "reporter", "hash": "1a99a5f9a50e5bac3b749d8558d5e46b"}, {"key": "description", "hash": "7471ec008a9c6fd70645b570c8e4606c"}, {"key": "published", "hash": "adaf791ca2f1e86d4ceb1cda34a13a7c"}, {"key": "type", "hash": "47c1f692ea47a21f716dad07043ade01"}, {"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cvss", "hash": "737e2591b537c46d1ca7ce6f0cea5cb9"}, {"key": "modified", "hash": "0d134bf170d66438eb1e01173ee0187f"}], "naslFamily": "CentOS Local Security Checks", "modified": "2017-07-10T00:00:00", "objectVersion": "1.3", "href": "http://plugins.openvas.org/nasl.php?oid=881758", "published": "2013-06-27T00:00:00", "enchantments": {"score": {"value": 6.8, "modified": "2017-07-25T10:51:48"}}, "id": "OPENVAS:881758", "title": "CentOS Update for curl CESA-2013:0983 centos6 ", "bulletinFamily": "scanner", "edition": 2, "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for curl CESA-2013:0983 centos6\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"cURL provides the libcurl library and a command line tool for downloading\n files from servers using various protocols, including HTTP, FTP, and LDAP.\n\n A heap-based buffer overflow flaw was found in the way libcurl unescaped\n URLs. A remote attacker could provide a specially-crafted URL that, when\n processed by an application using libcurl that handles untrusted URLs,\n would possibly cause it to crash or, potentially, execute arbitrary code.\n (CVE-2013-2174)\n\n Red Hat would like to thank the cURL project for reporting this issue.\n Upstream acknowledges Timo Sirainen as the original reporter.\n\n Users of curl should upgrade to these updated packages, which contain a\n backported patch to correct this issue. All running applications using\n libcurl must be restarted for the update to take effect.\";\n\n\ntag_affected = \"curl on CentOS 6\";\ntag_solution = \"Please Install the Updated Packages.\";\n\nif(description)\n{\n script_id(881758);\n script_version(\"$Revision: 6655 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 13:48:58 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2013-06-27 09:59:47 +0530 (Thu, 27 Jun 2013)\");\n script_cve_id(\"CVE-2013-2174\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_name(\"CentOS Update for curl CESA-2013:0983 centos6 \");\n\n script_xref(name: \"CESA\", value: \"2013:0983\");\n script_xref(name: \"URL\" , value: \"http://lists.centos.org/pipermail/centos-announce/2013-June/019810.html\");\n script_summary(\"Check for the Version of curl\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"CentOS6\")\n{\n\n if ((res = isrpmvuln(pkg:\"curl\", rpm:\"curl~7.19.7~37.el6_4\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libcurl\", rpm:\"libcurl~7.19.7~37.el6_4\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libcurl-devel\", rpm:\"libcurl-devel~7.19.7~37.el6_4\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "type": "openvas", "history": [], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "cvelist": ["CVE-2013-2174"], "lastseen": "2017-07-25T10:51:48", "pluginID": "881758"}, "differentElements": ["modified", "sourceData"], "edition": 2}], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "cvelist": ["CVE-2013-2174"], "lastseen": "2018-01-18T11:09:03", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for curl CESA-2013:0983 centos6\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"cURL provides the libcurl library and a command line tool for downloading\n files from servers using various protocols, including HTTP, FTP, and LDAP.\n\n A heap-based buffer overflow flaw was found in the way libcurl unescaped\n URLs. A remote attacker could provide a specially-crafted URL that, when\n processed by an application using libcurl that handles untrusted URLs,\n would possibly cause it to crash or, potentially, execute arbitrary code.\n (CVE-2013-2174)\n\n Red Hat would like to thank the cURL project for reporting this issue.\n Upstream acknowledges Timo Sirainen as the original reporter.\n\n Users of curl should upgrade to these updated packages, which contain a\n backported patch to correct this issue. All running applications using\n libcurl must be restarted for the update to take effect.\";\n\n\ntag_affected = \"curl on CentOS 6\";\ntag_solution = \"Please Install the Updated Packages.\";\n\nif(description)\n{\n script_id(881758);\n script_version(\"$Revision: 8448 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-17 17:18:06 +0100 (Wed, 17 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2013-06-27 09:59:47 +0530 (Thu, 27 Jun 2013)\");\n script_cve_id(\"CVE-2013-2174\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_name(\"CentOS Update for curl CESA-2013:0983 centos6 \");\n\n script_xref(name: \"CESA\", value: \"2013:0983\");\n script_xref(name: \"URL\" , value: \"http://lists.centos.org/pipermail/centos-announce/2013-June/019810.html\");\n script_tag(name: \"summary\" , value: \"Check for the Version of curl\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"CentOS6\")\n{\n\n if ((res = isrpmvuln(pkg:\"curl\", rpm:\"curl~7.19.7~37.el6_4\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libcurl\", rpm:\"libcurl~7.19.7~37.el6_4\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libcurl-devel\", rpm:\"libcurl-devel~7.19.7~37.el6_4\", rls:\"CentOS6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "pluginID": "881758"}
{"result": {"cve": [{"id": "CVE-2013-2174", "type": "cve", "title": "CVE-2013-2174", "description": "Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a \"%\" (percent) character.", "published": "2013-07-31T09:20:25", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2174", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-04-18T15:53:50"}], "nessus": [{"id": "DEBIAN_DSA-2713.NASL", "type": "nessus", "title": "Debian DSA-2713-1 : curl - heap overflow", "description": "Timo Sirainen discovered that cURL, an URL transfer library, is prone to a heap overflow vulnerability due to bad checking of the input data in the curl_easy_unescape function.\n\nThe curl command line tool is not affected by this problem as it doesn't use the curl_easy_unescape function.", "published": "2013-06-25T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=66974", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-10-29T13:39:56"}, {"id": "OPENSUSE-2013-552.NASL", "type": "nessus", "title": "openSUSE Security Update : curl / libcurl (openSUSE-SU-2013:1132-1)", "description": "A vulnerability was discovered for the curl and libcurl packages in openSUSE versions 12.2 and 12.3.", "published": "2014-06-13T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=75070", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-10-29T13:41:35"}, {"id": "FEDORA_2013-11521.NASL", "type": "nessus", "title": "Fedora 19 : curl-7.29.0-7.fc19 (2013-11521)", "description": "CVE-2013-2174 - fix heap-based buffer overflow in curl_easy_unescape()\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2013-07-12T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=67312", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-10-29T13:40:26"}, {"id": "UBUNTU_USN-1894-1.NASL", "type": "nessus", "title": "Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : curl vulnerability (USN-1894-1)", "description": "Timo Sirainen discovered that libcurl incorrectly handled memory when parsing URL encoded strings. An attacker could possibly use this issue to cause libcurl to crash, leading to a denial of service, or execute arbitrary code.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2013-07-03T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=67138", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-10-29T13:35:46"}, {"id": "SUSE_CURL-8614.NASL", "type": "nessus", "title": "SuSE 10 Security Update : curl (ZYPP Patch Number 8614)", "description": "This update of curl fixes several security issues.\n\n - libcurl URL decode buffer boundary flaw (bnc#824517 / CVE-2013-2174)", "published": "2013-07-11T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=67242", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-10-29T13:44:33"}, {"id": "SUSE_11_CURL-130618.NASL", "type": "nessus", "title": "SuSE 11.2 Security Update : curl (SAT Patch Number 7867)", "description": "This update of curl fixes several security issues :\n\n - libcurl URL decode buffer boundary flaw (bnc#824517 / CVE-2013-2174)", "published": "2013-07-10T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=67221", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-10-29T13:34:36"}, {"id": "SLACKWARE_SSA_2013-174-01.NASL", "type": "nessus", "title": "Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : curl (SSA:2013-174-01)", "description": "New curl packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix a security issue.", "published": "2013-06-24T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=66967", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-10-29T13:40:56"}, {"id": "REDHAT-RHSA-2013-0983.NASL", "type": "nessus", "title": "RHEL 5 / 6 : curl (RHSA-2013:0983)", "description": "Updated curl packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\ncURL provides the libcurl library and a command line tool for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nA heap-based buffer overflow flaw was found in the way libcurl unescaped URLs. A remote attacker could provide a specially crafted URL that, when processed by an application using libcurl that handles untrusted URLs, would possibly cause it to crash or, potentially, execute arbitrary code. (CVE-2013-2174)\n\nRed Hat would like to thank the cURL project for reporting this issue.\nUpstream acknowledges Timo Sirainen as the original reporter.\n\nUsers of curl should upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications using libcurl must be restarted for the update to take effect.", "published": "2013-06-26T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=66981", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-10-29T13:34:43"}, {"id": "FEDORA_2013-11574.NASL", "type": "nessus", "title": "Fedora 18 : curl-7.27.0-11.fc18 (2013-11574)", "description": "CVE-2013-2174 - fix heap-based buffer overflow in curl_easy_unescape()\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2013-07-12T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=67313", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-10-29T13:45:31"}, {"id": "CENTOS_RHSA-2013-0983.NASL", "type": "nessus", "title": "CentOS 5 / 6 : curl (CESA-2013:0983)", "description": "Updated curl packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\ncURL provides the libcurl library and a command line tool for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nA heap-based buffer overflow flaw was found in the way libcurl unescaped URLs. A remote attacker could provide a specially crafted URL that, when processed by an application using libcurl that handles untrusted URLs, would possibly cause it to crash or, potentially, execute arbitrary code. (CVE-2013-2174)\n\nRed Hat would like to thank the cURL project for reporting this issue.\nUpstream acknowledges Timo Sirainen as the original reporter.\n\nUsers of curl should upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications using libcurl must be restarted for the update to take effect.", "published": "2013-06-27T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=66998", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-10-29T13:37:48"}], "seebug": [{"id": "SSV:60852", "type": "seebug", "title": "cURL/libcURL 'curl_easy_unescape()'\u5806\u5185\u5b58\u7834\u574f\u6f0f\u6d1e", "description": "BUGTRAQ ID: 60737\r\nCVE(CAN) ID: CVE-2013-2174\r\n\r\ncURL\u662f\u547d\u4ee4\u884c\u4f20\u8f93\u6587\u4ef6\u5de5\u5177\uff0c\u652f\u6301FTP\u3001FTPS\u3001HTTP\u3001HTTPS\u3001GOPHER\u3001TELNET\u3001DICT\u3001FILE\u548cLDAP\u3002\r\n\r\ncURL 7.7 - 7.30.0\u7248\u672c\u5185\u7684\u51fd\u6570"curl_easy_unescape()"(lib/escape.c)\u5c06URL\u7f16\u7801\u7684\u5b57\u7b26\u4e32\u89e3\u7801\u4e3a\u539f\u59cb\u4e8c\u8fdb\u5236\u6570\u636e\u65f6\u51fa\u73b0\u8fb9\u754c\u9519\u8bef\uff0c\u6b64\u6f0f\u6d1e\u53ef\u88ab\u5229\u7528\u9020\u6210\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\uff0c\u5bfc\u81f4\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002\n0\ncURL 7.x\n\u4e34\u65f6\u89e3\u51b3\u65b9\u6cd5\uff1a\r\n\r\n\u5efa\u8bae\u60a8\u91c7\u53d6\u4ee5\u4e0b\u63aa\u65bd\u4ee5\u964d\u4f4e\u5a01\u80c1\uff1a\r\n\r\n* \u5347\u7ea7\u5230curl/libcurl 7.31.0\r\n\r\n* \u5e94\u7528\u8865\u4e01\uff0c\u91cd\u5efalibcurl\r\n\r\n http://curl.haxx.se/libcurl-unescape.patch\r\n\r\n* \u590d\u6838curl_easy_unescape()\uff0c\u6216\u4e0d\u4f7f\u7528\u6b64\u51fd\u6570\u3002\r\n\r\n\u5382\u5546\u8865\u4e01\uff1a\r\n\r\ncURL\r\n----\r\ncURL\u5df2\u7ecf\u4e3a\u6b64\u53d1\u5e03\u4e86\u4e00\u4e2a\u5b89\u5168\u516c\u544a\uff08adv_20130622\uff09\u4ee5\u53ca\u76f8\u5e94\u8865\u4e01:\r\nadv_20130622\uff1alibcurl URL decode buffer boundary flaw\r\n\u94fe\u63a5\uff1ahttp://curl.haxx.se/docs/adv_20130622.html\r\n\r\n\u8865\u4e01\u4e0b\u8f7d\uff1ahttp://curl.haxx.se/libcurl-unescape.patch", "published": "2013-06-26T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.seebug.org/vuldb/ssvid-60852", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-11-19T17:41:37"}], "openvas": [{"id": "OPENVAS:892713", "type": "openvas", "title": "Debian Security Advisory DSA 2713-1 (curl - heap overflow)", "description": "Timo Sirainen discovered that cURL, an URL transfer library, is prone to\na heap overflow vulnerability due to bad checking of the input data in\nthe curl_easy_unescape function.\n\nThe curl command line tool is not affected by this problem as it doesn't\nuse the curl_easy_unescape function.", "published": "2013-06-24T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=892713", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-07-24T12:51:57"}, {"id": "OPENVAS:1361412562310841498", "type": "openvas", "title": "Ubuntu Update for curl USN-1894-1", "description": "Check for the Version of curl", "published": "2013-07-05T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310841498", "cvelist": ["CVE-2013-2174"], "lastseen": "2018-04-06T11:21:31"}, {"id": "OPENVAS:1361412562310871013", "type": "openvas", "title": "RedHat Update for curl RHSA-2013:0983-01", "description": "Check for the Version of curl", "published": "2013-06-27T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310871013", "cvelist": ["CVE-2013-2174"], "lastseen": "2018-04-06T11:21:06"}, {"id": "OPENVAS:1361412562310881758", "type": "openvas", "title": "CentOS Update for curl CESA-2013:0983 centos6 ", "description": "Check for the Version of curl", "published": "2013-06-27T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310881758", "cvelist": ["CVE-2013-2174"], "lastseen": "2018-04-06T11:22:09"}, {"id": "OPENVAS:1361412562310892713", "type": "openvas", "title": "Debian Security Advisory DSA 2713-1 (curl - heap overflow)", "description": "Timo Sirainen discovered that cURL, an URL transfer library, is prone to\na heap overflow vulnerability due to bad checking of the input data in\nthe curl_easy_unescape function.\n\nThe curl command line tool is not affected by this problem as it doesn't\nuse the curl_easy_unescape function.", "published": "2013-06-24T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310892713", "cvelist": ["CVE-2013-2174"], "lastseen": "2018-04-06T11:23:14"}, {"id": "OPENVAS:1361412562310881754", "type": "openvas", "title": "CentOS Update for curl CESA-2013:0983 centos5 ", "description": "Check for the Version of curl", "published": "2013-06-27T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310881754", "cvelist": ["CVE-2013-2174"], "lastseen": "2018-04-09T11:22:22"}, {"id": "OPENVAS:881754", "type": "openvas", "title": "CentOS Update for curl CESA-2013:0983 centos5 ", "description": "Check for the Version of curl", "published": "2013-06-27T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=881754", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-07-25T10:51:37"}, {"id": "OPENVAS:1361412562310123603", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2013-0983", "description": "Oracle Linux Local Security Checks ELSA-2013-0983", "published": "2015-10-06T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310123603", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-07-24T12:52:33"}, {"id": "OPENVAS:871013", "type": "openvas", "title": "RedHat Update for curl RHSA-2013:0983-01", "description": "Check for the Version of curl", "published": "2013-06-27T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=871013", "cvelist": ["CVE-2013-2174"], "lastseen": "2018-01-22T13:09:39"}, {"id": "OPENVAS:841498", "type": "openvas", "title": "Ubuntu Update for curl USN-1894-1", "description": "Check for the Version of curl", "published": "2013-07-05T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=841498", "cvelist": ["CVE-2013-2174"], "lastseen": "2018-01-23T13:09:41"}], "slackware": [{"id": "SSA-2013-174-01", "type": "slackware", "title": "curl", "description": "New curl packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37,\n14.0, and -current to fix a security issue.\n\n\nHere are the details from the Slackware 14.0 ChangeLog:\n\npatches/packages/curl-7.29.0-i486-3_slack14.0.txz: Rebuilt.\n This fixes a minor security issue where a decode buffer boundary flaw in\n libcurl could lead to heap corruption.\n For more information, see:\n http://curl.haxx.se/docs/adv_20130622.html\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2174\n (* Security fix *)\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the "Get Slack" section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated package for Slackware 12.1:\nftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/curl-7.16.2-i486-4_slack12.1.tgz\n\nUpdated package for Slackware 12.2:\nftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/curl-7.19.6-i486-2_slack12.2.tgz\n\nUpdated package for Slackware 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/curl-7.19.6-i486-2_slack13.0.txz\n\nUpdated package for Slackware x86_64 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/curl-7.19.6-x86_64-2_slack13.0.txz\n\nUpdated package for Slackware 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/curl-7.20.1-i486-2_slack13.1.txz\n\nUpdated package for Slackware x86_64 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/curl-7.20.1-x86_64-2_slack13.1.txz\n\nUpdated package for Slackware 13.37:\nftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/curl-7.21.4-i486-2_slack13.37.txz\n\nUpdated package for Slackware x86_64 13.37:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/curl-7.21.4-x86_64-2_slack13.37.txz\n\nUpdated package for Slackware 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/curl-7.29.0-i486-3_slack14.0.txz\n\nUpdated package for Slackware x86_64 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/curl-7.29.0-x86_64-3_slack14.0.txz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/curl-7.31.0-i486-1.txz\n\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/curl-7.31.0-x86_64-1.txz\n\n\nMD5 signatures:\n\nSlackware 12.1 package:\n039f86b776fa836abe4f4153329bf4ab curl-7.16.2-i486-4_slack12.1.tgz\n\nSlackware 12.2 package:\n4cd279f928fa4e261f7b25cd5623ca1f curl-7.19.6-i486-2_slack12.2.tgz\n\nSlackware 13.0 package:\n271bb8f3842426959bd8dc62c9f91513 curl-7.19.6-i486-2_slack13.0.txz\n\nSlackware x86_64 13.0 package:\nb480f2128bf50e14a8943909b6aae236 curl-7.19.6-x86_64-2_slack13.0.txz\n\nSlackware 13.1 package:\ndc472f71102bec4454ee8cb9e01ab5ca curl-7.20.1-i486-2_slack13.1.txz\n\nSlackware x86_64 13.1 package:\n156aaad5fe806e6fdf8c2d01cf9a8f9d curl-7.20.1-x86_64-2_slack13.1.txz\n\nSlackware 13.37 package:\na52a03c063bf8e7fec021fbfb0bee2d7 curl-7.21.4-i486-2_slack13.37.txz\n\nSlackware x86_64 13.37 package:\n555ac66549322d731bf1e9940a145584 curl-7.21.4-x86_64-2_slack13.37.txz\n\nSlackware 14.0 package:\n4073372f0426b39c992f370b72638f4b curl-7.29.0-i486-3_slack14.0.txz\n\nSlackware x86_64 14.0 package:\na1580d839db13701f8775e77eeb4920b curl-7.29.0-x86_64-3_slack14.0.txz\n\nSlackware -current package:\n4ba53a308a7cf0545a1ecff82f216e20 n/curl-7.31.0-i486-1.txz\n\nSlackware x86_64 -current package:\nce783176b2c2e1bc117917ceb4fbfbdf n/curl-7.31.0-x86_64-1.txz\n\n\nInstallation instructions:\n\nUpgrade the package as root:\n > upgradepkg curl-7.29.0-i486-3_slack14.0.txz", "published": "2013-06-23T15:07:06", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.499592", "cvelist": ["CVE-2013-2174"], "lastseen": "2018-02-02T18:11:40"}], "ubuntu": [{"id": "USN-1894-1", "type": "ubuntu", "title": "curl vulnerability", "description": "Timo Sirainen discovered that libcurl incorrectly handled memory when parsing URL encoded strings. An attacker could possibly use this issue to cause libcurl to crash, leading to a denial of service, or execute arbitrary code.", "published": "2013-07-02T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://usn.ubuntu.com/1894-1/", "cvelist": ["CVE-2013-2174"], "lastseen": "2018-03-29T18:18:40"}], "debian": [{"id": "DSA-2713", "type": "debian", "title": "curl -- heap overflow", "description": "Timo Sirainen discovered that cURL, an URL transfer library, is prone to a heap overflow vulnerability due to bad checking of the input data in the curl_easy_unescape function.\n\nThe curl command line tool is not affected by this problem as it doesn't use the curl_easy_unescape function.\n\nFor the oldstable distribution (squeeze), this problem has been fixed in version 7.21.0-2.1+squeeze4.\n\nFor the stable distribution (wheezy), this problem has been fixed in version 7.26.0-1+wheezy3.\n\nFor the unstable distribution (sid), this problem has been fixed in version 7.31.0-1.\n\nWe recommend that you upgrade your curl packages.", "published": "2013-06-24T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://www.debian.org/security/dsa-2713", "cvelist": ["CVE-2013-2174"], "lastseen": "2016-09-02T18:22:58"}], "centos": [{"id": "CESA-2013:0983", "type": "centos", "title": "curl, libcurl security update", "description": "**CentOS Errata and Security Advisory** CESA-2013:0983\n\n\ncURL provides the libcurl library and a command line tool for downloading\nfiles from servers using various protocols, including HTTP, FTP, and LDAP.\n\nA heap-based buffer overflow flaw was found in the way libcurl unescaped\nURLs. A remote attacker could provide a specially-crafted URL that, when\nprocessed by an application using libcurl that handles untrusted URLs,\nwould possibly cause it to crash or, potentially, execute arbitrary code.\n(CVE-2013-2174)\n\nRed Hat would like to thank the cURL project for reporting this issue.\nUpstream acknowledges Timo Sirainen as the original reporter.\n\nUsers of curl should upgrade to these updated packages, which contain a\nbackported patch to correct this issue. All running applications using\nlibcurl must be restarted for the update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2013-June/019810.html\nhttp://lists.centos.org/pipermail/centos-announce/2013-June/019815.html\n\n**Affected packages:**\ncurl\ncurl-devel\nlibcurl\nlibcurl-devel\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2013-0983.html", "published": "2013-06-26T02:20:36", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2013-June/019810.html", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-10-03T18:26:19"}], "redhat": [{"id": "RHSA-2013:0983", "type": "redhat", "title": "(RHSA-2013:0983) Moderate: curl security update", "description": "cURL provides the libcurl library and a command line tool for downloading\nfiles from servers using various protocols, including HTTP, FTP, and LDAP.\n\nA heap-based buffer overflow flaw was found in the way libcurl unescaped\nURLs. A remote attacker could provide a specially-crafted URL that, when\nprocessed by an application using libcurl that handles untrusted URLs,\nwould possibly cause it to crash or, potentially, execute arbitrary code.\n(CVE-2013-2174)\n\nRed Hat would like to thank the cURL project for reporting this issue.\nUpstream acknowledges Timo Sirainen as the original reporter.\n\nUsers of curl should upgrade to these updated packages, which contain a\nbackported patch to correct this issue. All running applications using\nlibcurl must be restarted for the update to take effect.\n", "published": "2013-06-25T04:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://access.redhat.com/errata/RHSA-2013:0983", "cvelist": ["CVE-2013-2174"], "lastseen": "2017-12-25T20:05:29"}, {"id": "RHSA-2013:1076", "type": "redhat", "title": "(RHSA-2013:1076) Important: rhev-hypervisor6 security and bug fix update", "description": "The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization\nHypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor\nis a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes\neverything necessary to run and manage virtual machines: A subset of the\nRed Hat Enterprise Linux operating environment and the Red Hat Enterprise\nVirtualization Agent.\n\nNote: Red Hat Enterprise Virtualization Hypervisor is only available for\nthe Intel 64 and AMD64 architectures with virtualization extensions.\n\nIt was discovered that the fix for the CVE-2013-1619 issue released via\nRHSA-2013:0636 introduced a regression in the way GnuTLS decrypted TLS/SSL\nencrypted records when CBC-mode cipher suites were used. A remote attacker\ncould possibly use this flaw to crash a server or client application that\nuses GnuTLS. (CVE-2013-2116)\n\nThis updated package provides updated components that include fixes for\nvarious security issues. These issues have no security impact on Red Hat\nEnterprise Virtualization Hypervisor itself, however. The security fixes\nincluded in this update address the following CVE numbers:\n\nCVE-2013-2174 (curl issue)\n\nCVE-2012-6548, CVE-2013-0914, CVE-2013-1848, CVE-2013-2128, CVE-2013-2634,\nCVE-2013-2635, CVE-2013-2852, CVE-2013-3222, CVE-2013-3224, CVE-2013-3225,\nand CVE-2013-3301 (kernel issues)\n\nCVE-2002-2443 (krb5 issue)\n\nCVE-2013-1950 (libtirpc issue)\n\nUpgrade Note: If you upgrade the Red Hat Enterprise Virtualization\nHypervisor through the 3.2 Manager administration portal, the Host may\nappear with the status of \"Install Failed\". If this happens, place the host\ninto maintenance mode, then activate it again to get the host back to an\n\"Up\" state. \n\nThis update also contains the fixes from the following errata:\n\n* ovirt-node: RHBA-2013:1077\n\nUsers of the Red Hat Enterprise Virtualization Hypervisor are advised to\nupgrade to this updated package, which corrects these issues.\n", "published": "2013-07-16T04:00:00", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2013:1076", "cvelist": ["CVE-2013-2635", "CVE-2012-6548", "CVE-2013-1950", "CVE-2013-1848", "CVE-2013-1619", "CVE-2013-3224", "CVE-2013-2852", "CVE-2013-3301", "CVE-2013-2128", "CVE-2013-3225", "CVE-2013-3222", "CVE-2013-0914", "CVE-2013-2174", "CVE-2013-2634", "CVE-2002-2443", "CVE-2013-2116"], "lastseen": "2017-03-10T07:18:24"}], "oraclelinux": [{"id": "ELSA-2013-0983", "type": "oraclelinux", "title": "curl security update", "description": "[7.19.7-37]\n- fix heap-based buffer overflow in curl_easy_unescape() (CVE-2013-2174)", "published": "2013-06-25T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://linux.oracle.com/errata/ELSA-2013-0983.html", "cvelist": ["CVE-2013-2174"], "lastseen": "2016-09-04T11:16:38"}], "freebsd": [{"id": "01CF67B3-DC3B-11E2-A6CD-C48508086173", "type": "freebsd", "title": "cURL library -- heap corruption in curl_easy_unescape", "description": "\ncURL developers report:\n\nlibcurl is vulnerable to a case of bad checking of the\n\t input data which may lead to heap corruption.\nThe function curl_easy_unescape() decodes URL-encoded\n\t strings to raw binary data. URL-encoded octets are\n\t represented with %HH combinations where HH is a two-digit\n\t hexadecimal number. The decoded string is written to an\n\t allocated memory area that the function returns to the\n\t caller.\nThe function takes a source string and a length\n\t parameter, and if the length provided is 0 the function will\n\t instead use strlen() to figure out how much data to\n\t parse.\nThe \"%HH\" parser wrongly only considered the case where a\n\t zero byte would terminate the input. If a length-limited\n\t buffer was passed in which ended with a '%' character which\n\t was followed by two hexadecimal digits outside of the buffer\n\t libcurl was allowed to parse alas without a terminating\n\t zero, libcurl would still parse that sequence as well. The\n\t counter for remaining data to handle would then be decreased\n\t too much and wrap to become a very large integer and the\n\t copying would go on too long and the destination buffer that\n\t is allocated on the heap would get overwritten.\nWe consider it unlikely that programs allow user-provided\n\t strings unfiltered into this function. Also, only the not\n\t zero-terminated input string use case is affected by this\n\t flaw. Exploiting this flaw for gain is probably possible for\n\t specific circumstances but we consider the general risk for\n\t this to be low.\nThe curl command line tool is not affected by this\n\t problem as it doesn't use this function.\nThere are no known exploits available at this time.\n\n", "published": "2013-06-22T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vuxml.freebsd.org/freebsd/01cf67b3-dc3b-11e2-a6cd-c48508086173.html", "cvelist": ["CVE-2013-2174"], "lastseen": "2016-09-26T17:24:29"}], "gentoo": [{"id": "GLSA-201401-14", "type": "gentoo", "title": "cURL: Multiple vulnerabilities", "description": "### Background\n\ncURL is a command line tool for transferring files with URL syntax, supporting numerous protocols. \n\n### Description\n\nMultiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker could entice a user or automated process to connect to a malicious server using cURL, possibly resulting in the remote execution of arbitrary code or a Denial of Service condition. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll cURL users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-misc/curl-7.34.0-r1\"", "published": "2014-01-20T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://security.gentoo.org/glsa/201401-14", "cvelist": ["CVE-2013-6422", "CVE-2013-0249", "CVE-2013-1944", "CVE-2013-2174"], "lastseen": "2016-09-06T19:46:20"}], "oracle": [{"id": "ORACLE:CPUJUL2015-2367936", "type": "oracle", "title": "Oracle Critical Patch Update - July 2015", "description": "A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security fixes. Please refer to:\n\n \n\n\n[Critical Patch Updates and Security Alerts](<http://www.oracle.com/technetwork/topics/security/alerts-086861.html>) for information about Oracle Security Advisories.\n\n \n\n\n**Oracle continues to periodically receive reports of malicious exploitation of vulnerabilities for which Oracle has already released fixes. In some instances, it has been reported that malicious attackers have been successful because customers had failed to apply available Oracle patches. Oracle therefore _strongly_ recommends that customers remain on actively-supported versions and apply Critical Patch Update fixes _without_ delay.**\n\n \n\n\nThis Critical Patch Update contains 193 new security fixes across the product families listed below. Please note that a blog entry summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at <https://blogs.oracle.com/security>.\n\n \n\n\n** Please note that on May 15, 2015, Oracle released [Security Alert for CVE-2015-3456 (QEMU \"Venom\")](<http://www.oracle.com/technetwork/topics/security/alert-cve-2015-3456-2542656.html>). Customers of affected Oracle products are strongly advised to apply the fixes and/or configuration steps that were announced for CVE-2015-3456. **\n\n \n\n\nThis Critical Patch Update advisory is also available in an XML format that conforms to the Common Vulnerability Reporting Format (CVRF) version 1.1. More information about Oracle's use of CVRF is available at: <http://www.oracle.com/technetwork/topics/security/cpufaq-098434.html#CVRF>.\n\n \n\n", "published": "2015-07-14T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "", "cvelist": ["CVE-2015-1926", "CVE-2015-1802", "CVE-2015-4000", "CVE-2015-2591", "CVE-2015-0443", "CVE-2015-1803", "CVE-2015-4771", "CVE-2015-2627", "CVE-2015-2615", "CVE-2014-3566", "CVE-2015-4764", "CVE-2015-4774", "CVE-2015-2601", "CVE-2015-4738", "CVE-2014-8098", "CVE-2015-0235", "CVE-2015-4729", "CVE-2015-1804", "CVE-2015-4751", "CVE-2015-0444", "CVE-2015-0445", "CVE-2015-4749", "CVE-2014-8092", "CVE-2015-4758", "CVE-2014-7809", "CVE-2015-2643", "CVE-2015-4770", "CVE-2015-4747", "CVE-2015-2661", "CVE-2015-4778", "CVE-2015-2632", "CVE-2015-2625", "CVE-2015-2617", "CVE-2015-4784", "CVE-2015-2664", "CVE-2015-2605", "CVE-2015-2597", "CVE-2015-4785", "CVE-2015-4732", "CVE-2015-2653", "CVE-2014-3572", "CVE-2014-3613", "CVE-2015-0206", "CVE-2014-0227", "CVE-2015-2595", "CVE-2015-4782", "CVE-2015-0286", "CVE-2015-3244", "CVE-2015-2648", "CVE-2015-2657", "CVE-2014-0230", "CVE-2014-8100", "CVE-2015-4789", "CVE-2015-2581", "CVE-2015-2613", "CVE-2015-2658", "CVE-2014-3571", "CVE-2015-4736", "CVE-2015-2599", "CVE-2013-2251", "CVE-2013-5704", "CVE-2015-4739", "CVE-2015-0288", "CVE-2015-4790", "CVE-2013-6422", "CVE-2015-2589", "CVE-2010-1324", "CVE-2015-2623", "CVE-2015-2631", "CVE-2010-4020", "CVE-2015-2596", "CVE-2015-4763", "CVE-2015-0285", "CVE-2015-4783", "CVE-2015-2620", "CVE-2015-2650", "CVE-2011-3389", "CVE-2015-2654", "CVE-2015-0207", "CVE-2015-2607", "CVE-2015-2639", "CVE-2015-2611", "CVE-2015-2645", "CVE-2015-2634", "CVE-2015-2594", "CVE-2014-8275", "CVE-2015-3456", "CVE-2015-0467", "CVE-2015-2584", "CVE-2015-0208", "CVE-2015-2808", "CVE-2013-0249", "CVE-2014-3570", "CVE-2015-2590", "CVE-2015-2656", "CVE-2015-2626", "CVE-2015-2628", "CVE-2015-4768", "CVE-2015-4761", "CVE-2015-4745", "CVE-2015-4750", "CVE-2014-0139", "CVE-2015-2635", "CVE-2015-4756", "CVE-2015-2647", "CVE-2014-3707", "CVE-2015-0293", "CVE-2015-2600", "CVE-2015-2580", "CVE-2014-8097", "CVE-2014-8101", "CVE-2015-2640", "CVE-2015-4733", "CVE-2015-2646", "CVE-2014-1568", "CVE-2015-2651", "CVE-2015-2603", "CVE-2014-8091", "CVE-2015-4765", "CVE-2015-2660", "CVE-2015-2604", "CVE-2015-0255", "CVE-2015-4772", "CVE-2015-2662", "CVE-2015-4735", "CVE-2015-0468", "CVE-2015-4779", "CVE-2015-0209", "CVE-2015-2585", "CVE-2013-2186", "CVE-2014-3567", "CVE-2015-2614", "CVE-2014-0015", "CVE-2015-4737", "CVE-2015-4776", "CVE-2015-4757", "CVE-2015-4728", "CVE-2015-2637", "CVE-2015-2606", "CVE-2015-4769", "CVE-2015-0204", "CVE-2015-2621", "CVE-2015-4786", "CVE-2015-4787", "CVE-2015-2638", "CVE-2015-4740", "CVE-2015-2619", "CVE-2015-4731", "CVE-2014-8095", "CVE-2015-4727", "CVE-2015-4741", "CVE-2015-2636", "CVE-2015-2659", "CVE-2015-2655", "CVE-2015-4775", "CVE-2015-4773", "CVE-2014-8102", "CVE-2015-0291", "CVE-2015-4746", "CVE-2015-2629", "CVE-2014-8096", "CVE-2015-4788", "CVE-2015-4755", "CVE-2015-2602", "CVE-2015-4748", "CVE-2015-0287", "CVE-2015-2622", "CVE-2015-2610", "CVE-2012-0036", "CVE-2013-2174", "CVE-2015-2663", "CVE-2015-4742", "CVE-2014-8093", "CVE-2015-0289", "CVE-2015-2652", "CVE-2015-4759", "CVE-2015-0446", "CVE-2015-0292", "CVE-2015-2582", "CVE-2015-4780", "CVE-2014-1569", "CVE-2015-4781", "CVE-2015-2618", "CVE-2015-2641", "CVE-2015-2593", "CVE-2015-4744", "CVE-2015-2598", "CVE-2014-0138", "CVE-2015-2587", "CVE-2015-2630", "CVE-2015-2592", "CVE-2015-4767", "CVE-2015-0290", "CVE-2015-2616", "CVE-2015-0205", "CVE-2015-2624", "CVE-2015-2609", "CVE-2015-4777", "CVE-2010-1323", "CVE-2015-1787", "CVE-2015-4754", "CVE-2014-3569", "CVE-2015-2588", "CVE-2015-4760", "CVE-2015-2583", "CVE-2015-4743", "CVE-2013-4545", "CVE-2015-4752", "CVE-2015-2586", "CVE-2015-4753", "CVE-2015-2649", "CVE-2015-2612", "CVE-2015-2644"], "lastseen": "2018-04-18T20:24:06"}]}}