--write-out out of buffer read

There were two bugs in curl's parser for the command line option --write-out or -w for short that would skip the end of string zero byte if the string ended in a % percent or \ backslash, and it would read beyond that buffer in the heap memory and it could then potentially output pieces of that...

CURL-CVE-2017-7407 --write-out out of buffer read

There were two bugs in curl's parser for the command line option --write-out or -w for short that would skip the end of string zero byte if the string ended in a % percent or \ backslash, and it would read beyond that buffer in the heap memory and it could then potentially output pieces of that...

cURL -- potential memory disclosure

The cURL project reports: There were two bugs in curl's parser for the command line option --write-out or -w for short that would skip the end of string zero byte if the string ended in a % percent or \ backslash, and it would read beyond that buffer in the heap memory and it could then potential...

CVE-2017-7407: Improper Restriction of Operations within the Bounds of a Memory Buffer

The ourWriteOut function in toolwriteout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a...

UBUNTU-CVE-2017-7407

The ourWriteOut function in toolwriteout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a...

CVE-2017-7407

The ourWriteOut function in toolwriteout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a...

BSA-2017-216

Security Advisory ID : BSA-2017-216 Component : libcurl Revision : 1.0: Interim curl andlibcurlbefore 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loade...

macOS 10.12.x < 10.12.4 Multiple Vulnerabilities (httpoxy)

The remote host is running a version of macOS that is 10.12.x prior to 10.12.4. It is, therefore, affected by multiple vulnerabilities in multiple components, some of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these remote code execution...

cURL/libcURL incomplete fix for remote security bypass vulnerability

Haxx curl and libcurl are both products of the Swedish company Haxx. curl is a set of file transfer tools that utilize URL syntax to work at the command line. libcurl is a free, open source client-side URL transfer library. A remote security bypass vulnerability exists in Haxx curl and libcurl. A...

Oracle Linux 6 : curl (ELSA-2017-0847)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-0847 advisory. 7.19.7-53 - treat Negotiate authentication as connection-oriented CVE-2017-2628 Tenable has extracted the preceding description block directly from the Oracle...

curl: negotiate not treated as connection-oriented (incomplete fix for CVE-2015-3148)

It was found that the fix for CVE-2015-3148 in curl was incomplete. An application using libcurl with HTTP Negotiate authentication could incorrectly re-use credentials for subsequent requests to the same server...

Moderate: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

PT-2018-7147 · Red Hat · Curl +1

Name of the Vulnerable Software and Affected Versions: curl versions prior to 7.19.7-53 Description: The issue arises from an incorrect backport of a fix in curl, as shipped in Red Hat Enterprise Linux 6, due to a change in the HAVE GSSAPI define being substituted by USE HTTP NEGOTIATE. This...

curl security update

7.19.7-53 - treat Negotiate authentication as connection-oriented CVE-2017-2628...

DzSoft PHP Editor 4.2.7 - File Enumeration

DzSoft PHP Editor 4.2.7 - File Enumeration + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/DZSOFT-v4.2.7-PHP-EDITOR-FILE-ENUMERATION.txt + ISR: ApparitionSec Vendor: ============== www.dzsoft.com Product:...

cURL: Certificate validation error

Background cURL is a tool and libcurl is a library for transferring data with URL syntax. Description cURL and applications linked against libcurl support “OCSP stapling”, also known as the TLS Certificate Status Request extension using the CURLOPTSSLVERIFYSTATUS option. When telling cURL to use...

GLSA-201703-04 : cURL: Certificate validation error

The remote host is affected by the vulnerability described in GLSA-201703-04 cURL: Certificate validation error cURL and applications linked against libcurl support OCSP stapling, also known as the TLS Certificate Status Request extension using the CURLOPTSSLVERIFYSTATUS option. When telling cURL...

DzSoft PHP Editor 4.2.7 File Enumeration

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/DZSOFT-v4.2.7-PHP-EDITOR-FILE-ENUMERATION.txt + ISR: ApparitionSec Vendor: ============== www.dzsoft.com Product: ========================= DzSoft PHP Editor v4.2.7 DzSoft PHP...

Urban Dictionary: Session replay vulnerability in www.urbandictionary.com

Session replay vulnerability in www.urbandictionary.com I considered titling this bug "Session tokens not expiring", which is what you need to tell your development team. But I titled it as I did to emphasize at least one attack made possible by the bug. There may be others. Description Privilege...

Sparrow Web Server Directory Traversal

Title: Sparrow Web Server - Path Traversal Author: Nassim Asrir Contact: [email protected] || https://www.linkedin.com/in/nassim-asrir-b73a57122/ Researcher At: Henceforth CVE: N/A Vendor : https://github.com/codercheng/sparrow Download : https://github.com/codercheng/sparrow Vulnerability Type:...