KB5044273: Windows 10 version 21H2 / Windows 10 Version 22H2 Security Update (October 2024)

The remote Windows host is missing security update 5044273. It is, therefore, affected by multiple vulnerabilities - libcurl's ASN1 parser has this utf8asn1str function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also...

KB5044280: Windows 11 version 21H2 Security Update (October 2024)

The remote Windows host is missing security update 5044280. It is, therefore, affected by multiple vulnerabilities - libcurl's ASN1 parser has this utf8asn1str function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also...

RHSA-2024:3049 Red Hat Security Advisory: perl-Convert-ASN1 security update

Bulletin has no description...

CLSA-2024-1726313254 Fix CVE(s): CVE-2024-7264

SECURITY UPDATE: Heap Buffer Overflow in ASN.1 Parser - debian/patches/CVE-2024-7264.patch: Clean up GTime2str function to handle optional fractional seconds properly. Fix GTime2str issues and add unit tests to verify correct behaviour - CVE-2024-7264...

CBL Mariner 2.0 Security Update: curl (CVE-2024-6197)

The version of curl installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-6197 advisory. - libcurl's ASN1 parser has this utf8asn1str function used for parsing an ASN.1 UTF-8 string. Itcan detect an...

K000141062: libcurl vulnerability CVE-2024-7264

Security Advisory Description libcurl's ASN1 parser code has the GTime2str function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the time fraction, leading to a strlen getting performed on a pointe...

Fedora: Security Advisory (FEDORA-2023-31d5d51a2d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2023-11f1c85512)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OESA-2024-2092 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a field holding the buffer...

OESA-2024-2094 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a field holding the buffer...

OESA-2024-2093 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a field holding the buffer...

ROS-20240816-22

Vulnerability in the ASN1 Parser function GTime2str of the libcurl library is related to reading outside of memory boundaries memory. Exploitation of the vulnerability could allow an attacker acting remotely to cause an octasis in the maintenance...

ROS-20240816-02

Vulnerability in the ASN1 Parser function GTime2str of the libcurl library is related to reading outside of memory boundaries memory. Exploitation of the vulnerability could allow an attacker acting remotely to cause an octasis in the maintenance...

ROS-20240816-13

Vulnerability in the ASN1 Parser function GTime2str of the libcurl library is related to reading outside of memory boundaries memory. Exploitation of the vulnerability could allow an attacker acting remotely to cause an octasis in the maintenance...

ROS-20240812-34

A vulnerability in the utf8asn1str function of the ASN1 parser of the cURL command line utility is related to the release of previously unallocated memory when processing the ASN1 UTF-8 string. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

ROS-20240812-14

Vulnerability of the utf8asn1str function of the ASN1 parser of the cURL command line utility is related to the release of previously unallocated memory when processing the ASN1 UTF-8 string. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

CVE-2024-7264

A flaw was found in libcurl, where libcurl's ASN1 parser code has the GTime2str function, used for parsing an ASN.1 Generalized Time field. If a syntactically incorrect field is given, the parser can use -1 for the length of the time fraction, leading to a strlen performed on a pointer to a heap...

The vulnerability of the utf8asn1str() function in the ASN1 parser’s command-line utility cURL allows a attacker to execute arbitrary code or cause a service failure.

The vulnerability of the utf8asn1str function in the ASN1 parser’s command-line utility cURL is related to the release of previously unallocated memory during the processing of ASN1 UTF-8 strings. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause service...

Curl 7.32.0 < 8.9.1 DoS (CVE-2024-7264)

The version of Curl installed on the remote host is between 7.32.0 and prior to 8.9.1. It is, therefore, affected by a denial of service DoS vulnerability. libcurl's ASN1 parser code has the GTime2str function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect...

libcurl 7.32.0 < 8.9.1 DoS (CVE-2024-7264)

The version of libcurl installed on the remote host is between 7.32.0 and prior to 8.9.1. It is, therefore, affected by a denial of service DoS vulnerability. libcurl's ASN1 parser code has the GTime2str function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorre...