63 matches found
[SECURITY] Fedora 32 Update: mingw-curl-7.71.1-1.fc32
cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...
curl: Integer overflow leading to heap-based buffer overflow in Curl_sasl_create_plain_message()
Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service...
ALPINE-CVE-2017-2629
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server...
The vulnerability of the syntax analyzer of the software tool for interacting with the curl server allows a hacker to perform read operations beyond the buffer in memory.
The vulnerability of the software tool’s syntax analyzer for interacting with servers using curl is related to an error during registration on the server using the FTP protocol. Exploiting this vulnerability allows a malicious actor to gain access to data beyond the boundaries of the allocated...
Gespage 7.4.8 - SQL Injection
CVE-2017-7997 Gespage SQL Injection vulnerability Description Gespage is a web solution providing a printer portal. Official Website: http://www.gespage.com/ The web application does not properly filter several parameters sent by users, allowing authenticated SQL code injection Stacked Queries -...
URL globbing out of bounds read
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a...
cURL Information Disclosure Vulnerability
cURL is a command line file transfer tool that supports FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE and LDAP. An information disclosure vulnerability exists in the ourWriteOut function of toolwriteout.c in cURL 7.53.1, where an attacker can obtain sensitive information by reading the...
SSL_VERIFYSTATUS ignored
curl and libcurl support "OCSP stapling", also known as the TLS Certificate Status Request extension using the CURLOPTSSLVERIFYSTATUS option. When telling curl to use this feature, it uses that TLS extension to ask for a fresh proof of the server's certificate's validity. If the server does not...
cURL/libcURL Security Bypass Vulnerability (CNVD-2016-10788)
cURL/libcURL is a command line file transfer tool that supports FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE and LDAP. A security bypass vulnerability exists in cURL/libcURL, which allows attackers to bypass security restrictions and perform unauthorized operations...
curl: Incorrect reuse of client certificates
It was found that the libcurl library using the NSS Network Security Services library as TLS/SSL backend incorrectly re-used client certificates for subsequent TLS connections in certain cases. An attacker could potentially use this flaw to hijack the authentication of the connection by leveragin...
glob parser write/read out of bounds
The curl tool's "globbing" feature allows a user to specify a numerical range through which curl iterates. It is typically specified as 1-5, specifying the first and the last numbers in the range. Or with a-z, using letters. 1. The curl code for parsing the second unsigned number did not check fo...
CURL-CVE-2016-8620 glob parser write/read out of bounds
The curl tool's "globbing" feature allows a user to specify a numerical range through which curl iterates. It is typically specified as 1-5, specifying the first and the last numbers in the range. Or with a-z, using letters. 1. The curl code for parsing the second unsigned number did not check fo...
cURL and libcurl Information Disclosure Vulnerability
cURL/libcURL is a command line file transfer tool that supports FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE and LDAP. When cURL and libcurl reuse the curleasyreset connection handle to send requests to the same hostname, they are accompanied by the HTTP Basic authentication credentials of...
SUSE SLED11 / SLES11 Security Update : curl (SUSE-SU-2015:0962-1)
The curl tool and libcurl4 library have been updated to fix several security and non-security issues. The following vulnerabilities have been fixed : CVE-2015-3143: Re-using authenticated connection when unauthenticated. bsc927556 CVE-2015-3148: Negotiate not treated as connection-oriented...
[SECURITY] Fedora 21 Update: mingw-curl-7.42.0-1.fc21
cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...
DEBIAN-CVE-2015-3153
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents...
cURL and libcurl Denial of Service Vulnerabilities (CNVD-2015-02754)
CURL is a set of file transfer tools that utilize URL syntax to work at the command line.Libcurl is a free, open source client-side URL transfer library. A security vulnerability exists in the 'fixhostname' function in cURL and libcurl versions 7.37.0 through 7.41.0, which stems from the program'...
DEBIAN-CVE-2014-3620
cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain...
[SECURITY] Fedora 19 Update: mingw-curl-7.37.0-1.fc19
cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...
CentOS Update for curl CESA-2010:0329 centos4 i386
Check for the Version of curl OpenVAS Vulnerability Test CentOS Update for curl CESA-2010:0329 centos4 i386 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...