11422 matches found
FreeBSD : cURL -- uninitialized random vulnerability (c40ca16c-4d9f-4d70-8b6c-4d53aeb8ead4)
Project curl Security Advisory : libcurl's new internal function that returns a good 32bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to. This random value is used to generate nonces for Digest and NTLM...
uninitialized random
libcurl's new internal function that returns a good 32-bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to. This random value is used to generate nonces for Digest and NTLM authentication, for generating boundary...
CURL-CVE-2016-9594 uninitialized random
libcurl's new internal function that returns a good 32-bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to. This random value is used to generate nonces for Digest and NTLM authentication, for generating boundary...
Security fix for the ALT Linux 8 package curl version 7.52.1-alt1
Dec. 23, 2016 Anton Farygin 7.52.1-alt1 - new version with security fixes: CVE-2016-9594: uninitialized random...
cURL/libcURL Buffer Overflow Vulnerability
Haxx curl and libcurl are both products of the Swedish company Haxx. curl is a set of file transfer tools that utilize URL syntax to work at the command line. libcurl is a free, open source client-side URL transfer library. A buffer overflow vulnerability exists in Haxx curl and libcurl versions...
FreeBSD : cURL -- buffer overflow (42880202-c81c-11e6-a9a5-b499baebfeaf)
The cURL project reports : printf floating point buffer overflow libcurl's implementation of the printf functions triggers a buffer overflow when doing a large floating point output. The bug occurs when the conversion outputs more than 255 bytes. %NASLMINLEVEL 70300 C Tenable Network Security, In...
CURL-CVE-2016-9953 Win CE Schannel cert name out of buffer read
curl's TLS server certificate checks are flawed on Windows CE. This vulnerability occurs in the verify certificate function when comparing a wildcard certificate name as returned by the Windows API function CertGetNameString to the hostname used to make the connection to the server. The pattern...
CURL-CVE-2016-9952 Win CE Schannel cert wildcard matches too much
curl's TLS server certificate checks are flawed on Windows CE. This vulnerability occurs in the verify certificate function when comparing a wildcard certificate name as returned by the Windows API function CertGetNameString to the hostname used to make the connection to the server. The...
UBUNTU-CVE-2016-9586
curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks...
Security fix for the ALT Linux 8 package curl version 7.52.0-alt1
Dec. 21, 2016 Anton Farygin 7.52.0-alt1 - new version with security fixes: CVE-2016-9586: printf floating point buffer overflow...
cURL -- buffer overflow
The cURL project reports: printf floating point buffer overflow libcurl's implementation of the printf functions triggers a buffer overflow when doing a large floating point output. The bug occurs when the conversion outputs more than 255 bytes...
The Nagios Core code execution vulnerability, CVE-2016-9565 analysis-vulnerability warning-the black bar safety net
Author: p0wd3r, dawu know Chong Yu 404 security lab Date: 2016-12-15 0x00 vulnerability overview 1. Vulnerability description Nagios is a monitoring of the IT infrastructure program, recently security researchers Dawid Golunski found in Nagios Core there is a code execution vulnerability: an...
macOS 10.12.x < 10.12.2 Multiple Vulnerabilities
The remote host is running a version of macOS that is 10.12.x prior to 10.12.2. It is, therefore, affected by multiple vulnerabilities in the following components : - apachemodphp - AppleGraphicsPowerManagement - Assets - Audio - Bluetooth - CoreCapture - CoreFoundation - CoreGraphics - CoreMedia...
Important: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP 2.4.23 Release
Red Hat JBoss Core Services httpd 2.4.23 is now available from the Red Hat Customer Portal for Solaris and Microsoft Windows systems. Red Hat Product Security has rated this release as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...
curl: TLS session resumption client cert bypass
It was found that the libcurl library did not prevent TLS session resumption when the client certificate had changed. An attacker could potentially use this flaw to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate...
curl: Incorrect reuse of client certificates
It was found that the libcurl library using the NSS Network Security Services library as TLS/SSL backend incorrectly re-used client certificates for subsequent TLS connections in certain cases. An attacker could potentially use this flaw to hijack the authentication of the connection by leveragin...
Nagios Core Curl Command Injection / Code Execution
/ / / / / / / / / / / / / / / / / / // / / / /// / / / / // / // / // / / / / // / // , / / / ///, /,// // //,///||// // // ============================================= - Discovered by: Dawid Golunski - dawidatlegalhackers.com - https://legalhackers.com - CVE-2016-9565 - Release date:...
Nagios 4.2.2 - Arbitrary Code Execution
Nagios 4.2.2 - Arbitrary Code Execution !/usr/bin/env python Source: https://legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html intro = """\03394m Nagios Core 4.2.0 Curl Command Injection / Code Execution PoC Exploit CVE-2016-9565 nagioscmdinjection.py ver...
Scientific Linux Security Update : curl on SL7.x x86_64 (20161103)
Security Fixes : - It was found that the libcurl library did not prevent TLS session resumption when the client certificate had changed. An attacker could potentially use this flaw to hijack the authentication of the connection by leveraging a previously created connection with a different client...
Nagios Core < 4.2.2 Curl Command Injection/Code Execution （CVE-2016-9565）
Author: p0wd3r, dawu know Chong Yu 404 security lab Date: 2016-12-15 0x00 vulnerability overview 1. Vulnerability description Nagios is a monitoring of the IT infrastructure program, recently security researchers Dawid Golunski discovered in Nagios Core there is a code execution vulnerability: an...