Important: curl

Issue Overview: HTTP headers eat all memory NOTE: https://www.openwall.com/lists/oss-security/2023/09/13/1 NOTE: https://curl.se/docs/CVE-2023-38039.html NOTE: Introduced by: https://github.com/curl/curl/commit/7c8c723682d524ac9580b9ca3b71419163cb5660 curl-7830 NOTE: Experimental tag removed in:...

CVE-2023-33270

CVE-2023-33270 affects DTS Monitoring 3.57.0. The issue is a blind OS command injection in the url parameter of the Curl check function, enabling arbitrary command execution with high impact (C/H/I/H) per the CVSS 3.1 vector. Connected sources confirm the vulnerable component and root cause but d...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-368)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-368 advisory. HTTP headers eat all memory NOTE: https://www.openwall.com/lists/oss-security/2023/09/13/1NOTE: https://curl.se/docs/CVE-2023-38039.htmlNOTE: Introduced by:...

Improper Encoding

firefox is vulnerable to Improper Encoding. The vulnerability exists due to improperly validating curl command which allows an attacker to cause unintended behavior in smart contracts that rely on the sender's accurate identification...

Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities

Summary IBM Cloud Transformation Advisor has addressed multiple security vulnerabilities listed herein, including those in Java, Go, Python and Node.js Vulnerability Details CVEID:CVE-2023-2602 DESCRIPTION: libcap is vulnerable to a denial of service, caused by a memory leak flaw in the error...

curl -- SOCKS5 heap buffer overflow

The curl team reports: This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255...

SUSE SLED15: curl / libcurl-devel / libcurl-devel-32bit / libcurl4 / etc (SUSE-SU-2023:3823-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3823-1 advisory. - CVE-2023-38039: Fixed possible DoS when receiving too large HTTP header. bsc1215026 Tenable has extract...

SUSE-SU-2023:3823-1 Security update for curl

This update for curl fixes the following issues: - CVE-2023-38039: Fixed possible DoS when receiving too large HTTP header. bsc1215026...

Fedora: Security Advisory for curl (FEDORA-2023-98dff7aae5)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 37 Update: curl-7.85.0-11.fc37

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Fedora: Security Advisory (FEDORA-2023-43ef9f5376)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 37 : curl (2023-98dff7aae5)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-98dff7aae5 advisory. - fix HTTP headers eat all memory CVE-2023-38039 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC

Summary There are multiple vulnerabilities in Curl that affect PowerSC. Vulnerability Details CVEID:CVE-2023-28320 DESCRIPTION: cURL libcurl is vulnerable to a denial of service, caused by a race condition flaw in the siglongjmp function. By sending a specially crafted request, a remote attacker...

Security Bulletin: IBM Event Streams is affected by a libcurl vulnerability

Summary cURL libcurl is used by IBM Event Streams as part of the Operating System CVE-2023-27534. The library supports retrieving data in-memory, downloading to disk, or streaming using the R "connection" interface. Vulnerability Details CVEID:CVE-2023-27534 DESCRIPTION: cURL libcurl could allow ...

Mageia: Security Advisory (MGASA-2023-0263)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2023-0263 Updated curl packages fix security vulnerability

TELNET option IAC injection. CVE-2023-27533 SFTP path resolving discrepancy. CVE-2023-27534 FTP too eager connection reuse. CVE-2023-27535 GSS delegation too eager connection re-use. CVE-2023-27536 HSTS double free. CVE-2023-27537 SSH connection too eager reuse still. CVE-2023-27538 UAF in SSH...

Updated curl packages fix security vulnerability

TELNET option IAC injection. CVE-2023-27533 SFTP path resolving discrepancy. CVE-2023-27534 FTP too eager connection reuse. CVE-2023-27535 GSS delegation too eager connection re-use. CVE-2023-27536 HSTS double free. CVE-2023-27537 SSH connection too eager reuse still. CVE-2023-27538 UAF in SSH...

SUSE: Security Advisory (SUSE-SU-2023:3692-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Essbase Multiple Vulnerabilities (October 2022 CPU)

The version of Oracle Essbase installed on the remote host is missing a security patch from the October 2022 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities, including: - Vulnerability in Oracle Essbase component: Build cURL. The supported version that is affecte...

SUSE SLES12 Security Update : curl (SUSE-SU-2023:3692-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3692-1 advisory. - CVE-2023-38039: Fixed possible DoS when receiving too large HTTP header. bsc1215026 Tenable has extracted the preceding description block...