Update of libcurl-devel, libcurl-devel, libcurl, curl, libcurl

...

ProcessMaker 3.5.4 - Local File inclusion Vulnerability

Exploit Title: ProcessMaker 3.5.4 - Local File inclusion Exploit Author: Ai Ho @j3ssiejjj Date: 16-04-2021 Vendor Homepage: https://www.processmaker.com/ Version: ProcessMaker = 3.5.4 References: https://github.com/jaeles-project/jaeles-signatures/blob/master/common/process-maker-lfi.yaml PoC: Wi...

curl (>=0.4.7, <=0.4.8), dns-lookup (>=0.7.0, <=0.8.1) +5 more potentially affected by CVE-2020-35919 +1 more via socket2 (0.2.4)

socket2 CARGO version 0.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on socket2 and may be impacted: - curl =0.4.7, =0.7.0, =0.3.0-beta.1, =0.1.0, =0.2.2, =0.2.4 - miow 0.3.0 Source cves: CVE-2020-35919, CVE-2020-35920 Source advisory:...

CVE-2021-22922

A flaw was found in curl in the way curl handles a file hash mismatch after downloading content using the Metalink feature. This flaw allows malicious actors controlling a hosting server to trick users into downloading malicious content. The highest threat from this vulnerability is to integrity...

Important Photon OS Security Update - PHSA-2021-0086

Updates of 'curl' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2021-4.0-0086

Updates of 'curl' packages of Photon OS have been released...

SafeCurl 安全漏洞

SafeCurl is open source SSRF protection library for PHP cURL extensions. A security vulnerability exists in SafeCurl versions prior to 0.9.2. No further information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement!...

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`) a malicious user can create a file name with the same name as the app wants to use by name and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.

...

When curl is instructed to get content using the metalink feature and a user name and password are used to download the metalink XML file those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

...

[SECURITY] [DLA 2734-1] curl security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2734-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk August 09, 2021 https://wiki.debian.org/LTS -...

Debian DLA-2734-1 : curl - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2734 advisory. - curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPTTELNETOPTIONS in libcurl, is used to send...

Debian: Security Advisory (DLA-2734-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for curl (FEDORA-2021-5d21b90a30)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2021-22922 affecting package curl 7.76.0-9

CVE-2021-22922 affecting package curl 7.76.0-9. A patched version of the package is available...

CVE-2021-22923 affecting package curl 7.76.0-9

CVE-2021-22923 affecting package curl 7.76.0-9. A patched version of the package is available...

CVE-2021-22890 affecting package curl 7.74.0-1

CVE-2021-22890 affecting package curl 7.74.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2020-8169 affecting package curl 7.68.0-5

CVE-2020-8169 affecting package curl 7.68.0-5. An upgraded version of the package is available that resolves this issue...

CVE-2021-22925 affecting package curl 7.76.0-9

CVE-2021-22925 affecting package curl 7.76.0-9. A patched version of the package is available...

Security Bulletin: A vulnerability was identified and remediated in the IBM MaaS360 Cloud Extender (V2.103.000.051) and Modules

Summary A vulnerability was identified and remediated in the IBM MaaS360 Cloud Extender Agent V2.103.000.051 and Modules. Vulnerability Details CVEID: CVE-2021-22890 DESCRIPTION: cURL libcurl is vulnerable to a man-in-the-middle attack, caused by a session tickets confusing issue when using a HTT...

EulerOS 2.0 SP9 : curl (EulerOS-SA-2021-2265)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS,...