SUSE-SU-2019:2339-2 Security update for curl

This update for curl fixes the following issues: Security issue fixed: - CVE-2019-5482: Fixed TFTP small blocksize heap buffer overflow bsc1149496...

[slackware-security] curl

New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/curl-7.66.0-i586-1slack14.2.txz: Upgraded. This update fixes security issues: FTP-KRB double-free TFTP small blocksize heap...

Ubuntu 16.04 LTS / 18.04 LTS : curl vulnerabilities (USN-4129-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4129-1 advisory. Thomas Vegas discovered that curl incorrectly handled memory when using Kerberos over FTP. A remote attacker could use this issue to crash...

Slackware 14.0 / 14.1 / 14.2 / current : curl (SSA:2019-254-01)

New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2019-254-01. The text itself is copyright C Slackware Linux,...

Photon OS 2.0: Curl PHSA-2019-2.0-0171

An update of the curl package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-2.0-0171. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid128714;...

Ubuntu: Security Advisory (USN-4129-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4129-1 curl vulnerabilities

Thomas Vegas discovered that curl incorrectly handled memory when using Kerberos over FTP. A remote attacker could use this issue to crash curl, resulting in a denial of service. CVE-2019-5481 Thomas Vegas discovered that curl incorrectly handled memory during TFTP transfers. A remote attacker...

USN-4129-1: curl vulnerabilities

Thomas Vegas discovered that curl incorrectly handled memory when using Kerberos over FTP. A remote attacker could use this issue to crash curl, resulting in a denial of service. CVE-2019-5481 Thomas Vegas discovered that curl incorrectly handled memory during TFTP transfers. A remote attacker...

FTP-KRB double free

libcurl can be told to use kerberos over FTP to a server, as set with the CURLOPTKRBLEVEL option. During such kerberos FTP data transfer, the server sends data to curl in blocks with the 32-bit size of each block first and then that amount of data immediately following. A malicious or broken serv...

TFTP small blocksize heap buffer overflow

libcurl contains a heap buffer overflow in the function tftpreceivepacket that receives data from a TFTP server. It can call recvfrom with the default size for the buffer rather than with the size that was used to allocate it. Thus, the content that might overwrite the heap memory is controlled b...

CURL-CVE-2019-5481 FTP-KRB double free

libcurl can be told to use kerberos over FTP to a server, as set with the CURLOPTKRBLEVEL option. During such kerberos FTP data transfer, the server sends data to curl in blocks with the 32-bit size of each block first and then that amount of data immediately following. A malicious or broken serv...

UBUNTU-CVE-2019-5481

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3...

NewStart CGSL CORE 5.05 / MAIN 5.05 : curl Vulnerability (NS-SA-2019-0171)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has curl packages installed that are affected by a vulnerability: - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curlntlmcoremknthash multiplies the length ...

CVE-2019-5481

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3...

UBUNTU-CVE-2019-5482

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3...

EMAGNET - Tool For Find Leaked Databases With 97.1% Accurate To Grab Mail + Password Together From Pastebin Leaks

Emagnet is a very powerful tool for it's purpose wich is to capture email addresses and passwords from leaked databases uploaded on pastebin. It's almost impossible to find leaked passwords when they are out of list on pastebin.com. Either they have been deleted by pastebin's techs or the uploads...

curl: Incorrect IPv6 literal parsing leads to validated connection to unexpected https server.

Summary: The IPv6 ip address can be specified with square brackets like fe80::3. There can also be a zone id specified like fe80::3%15. A URL can specify its hostname with IPv6 literal, It seems that the parsing in curl library is not complete. For instance, it is possible for particular IPv6...

curl: Double-free of `trailers_buf' on `Curl_http_compile_trailers()` failure

Summary: When Curlhttpcompiletrailers fails, trailersbuf is freed twice, because we don't pass to this function the pointer value by reference. Steps To Reproduce: Did not actually reproduce, please double check patch attached and analysis. Impact Some memory corruption due to the double-free...

curl:curl_fuzzer_smtp: Use-of-uninitialized-value in smtp_state_ehlo_resp

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5634440956477440 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzersmtp Job Type: libfuzzermsancurl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

curl:curl_fuzzer_smb: Use-of-uninitialized-value in smb_connection_state

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5642303913328640 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzersmb Job Type: libfuzzermsancurl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...