Astra Linux – Vulnerability in curl

There is a path traversal vulnerability in the 8.0.0 SFTP implementation of curl. This vulnerability causes the tilde character to be incorrectly replaced when used as a prefix in the first path element. Additionally, the tilde is intended to be used as the first element to indicate a path relati...

Astra Linux – Vulnerability in curl

Curl versions 7.62.0 through 7.70.0 are vulnerable to an information disclosure vulnerability that can result in a partial password being leaked over the network and to the DNS servers...

Astra Linux – Vulnerability in curl

There is a vulnerability in curl v7.88.0 where resource allocation without limits or throttling exists. This vulnerability stems from the “chained” HTTP compression algorithms. This means that a server’s response can be compressed multiple times, possibly using different algorithms. The number of...

Astra Linux – Vulnerability in curl

When performing HTTPS transfers, libcurl may incorrectly use the read callback CURLOPTREADFUNCTION to request data to be sent, even when the CURLOPTPOSTFIELDS option has been set. This occurs if the same handle was previously used to issue a PUT request that utilized that callback. This flaw may...

Astra Linux – Vulnerability in curl

There is an improper authentication vulnerability in curl versions 7.33.0 through and including 7.82.0. This vulnerability may allow for the reuse of OAUTH2-authenticated connections without ensuring that the connection was authentically verified with the same credentials used for this transfer...

Astra Linux – Vulnerability in curl

curl 7.1.1 up to and including 7.75.0 is vulnerable to a “Exposure of Private Personal Information to an Unauthorized Actor” by leaking credentials in the HTTP Referer: header. libcurl does not remove user credentials from the URL when automatically filling in the Referer: HTTP request header fie...

Astra Linux – Vulnerability in curl

A user can specify that curl = 7.20.0 and = 7.78.0 requires a successful upgrade to TLS when communicating with IMAP, POP3, or FTP servers. This is achieved by using the --ssl-reqd option on the command line, or setting CURLOPT USESSL to CURLUSESSLCONTROL or CURLUSESSLALL with licurl. This...

Astra Linux – Vulnerability in Firefox

Due to insufficient escaping of special characters in the “copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user’s system. This vulnerability was fixed in Firefox 138 and Thunderbird 138...

Astra Linux – Vulnerability in curl

When curl is instructed to use the Certificate Status Request TLS extension, also known as OCSP stapling, to verify that the server certificate is valid, it may fail to detect certain OCSP issues and instead incorrectly consider the response to be fine. If the returned status reports an error oth...

Astra Linux – Vulnerability in curl

In some cases, curl may reuse the wrong connection for SMB transfers. curl features a pool of recent connections, so subsequent requests can reuse an existing connection to avoid additional overhead. When reusing a connection, a set of criteria must be met. Due to a logical error in the code, a...

Astra Linux – Vulnerability in curl

curl will incorrectly reuse an existing HTTP proxy connection when making a CONNECT request to a server, even if the new request uses different credentials for the HTTP proxy. The correct behavior is to create or use a separate connection...

Astra Linux – Vulnerability in curl

A poorly protected credentials vulnerability exists in curl 4.9, and versions including curl 7.82.0 are also affected. This vulnerability could allow attackers to extract credentials when using HTTPS redirections with authentication. As a result, credentials may be leaked to other services that...

Astra Linux – Vulnerability in curl

Curl versions 7.41.0 through 7.73.0 are vulnerable to a flaw related to improper checks for certificate revocation, due to insufficient verification of the OCSP response...

Astra Linux – Vulnerability in LibreOffice

A vulnerability in certificate validation in LibreOffice’s “LibreOfficeKit” mode disables TLS certificate verification. LibreOfficeKit can be used to access LibreOffice functionality through C/C++. Typically, this is used by third-party components to reuse LibreOffice as a library for converting,...

Astra Linux – Vulnerability in curl

Due to the use of a dangling pointer, libcurl versions 7.29.0 through 7.71.1 can use the wrong connection when sending data...

Astra Linux – Vulnerability in Firefox and Thunderbird

Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user’s system. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11,...

Astra Linux – Vulnerability in curl

Curl versions 7.63.0 through 7.75.0 include a vulnerability that allows a malicious HTTPS proxy to intercept connections by mishandling TLS 1.3 session tickets. When using an HTTPS proxy and TLS 1.3, libcurl may misinterpret session tickets sent from the HTTPS proxy as those originating from the...

RHSA-2026:57462 Red Hat Security Advisory: curl security, bug fix, and enhancement update

Bulletin has no description...

RLSA-2026:57462 Important: curl security, bug fix, and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-8286 Bug Fixes and Enhancements:...

curl security, bug fix, and enhancement update

An update is available for curl. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for downloadi...