CentOS 7 : curl (CESA-2019:2181)

An update for curl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE li...

Scientific Linux Security Update : curl on SL7.x x86_64 (20190806)

Security Fixes : - curl: Heap-based buffer over-read in the curl tool warning formatting CVE-2018-16842 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128212; scriptversion"1.4";...

curl:curl_fuzzer_smb: Heap-buffer-overflow in to_u32

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5714596706385920 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzersmb Job Type: libfuzzerasani386curl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0xf5902f48 Cra...

curl:curl_fuzzer_smtp: Negative-size-param in fuzz_tlv_to_string

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=6288244651589632 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzersmtp Job Type: libfuzzerasani386curl Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State:...

curl:curl_fuzzer_pop3: Use-of-uninitialized-value in dprintf_formatf

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5716063639044096 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerpop3 Job Type: libfuzzermsancurl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

curl:curl_fuzzer_pop3: Use-of-uninitialized-value in Curl_rand_hex

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5707860721270784 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerpop3 Job Type: libfuzzermsancurl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

curl:curl_fuzzer_rtmp: Negative-size-param in fuzz_tlv_to_string

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5639027763445760 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerrtmp Job Type: libfuzzerasani386curl Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State:...

curl:curl_fuzzer: Use-of-uninitialized-value in getrn

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5703353153093632 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzer Job Type: libfuzzermsancurl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: getrn...

EulerOS 2.0 SP5 : curl (EulerOS-SA-2019-1809)

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.CVE-2019-5436...

Webmin 1.920 - Remote Code Execution

!/bin/sh CVE-2019-15107 Webmin Unauhenticated Remote Command Execution based on Metasploit module https://www.exploit-db.com/exploits/47230 Original advisory: https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html Alternative advisory spanish:...

Joomla JS Jobs 1.2.6 Arbitrary File Delete

Exploit Title: Joomla! component comjsjobs 1.2.6 - Arbitrary File Deletion Dork: inurl:"index.php?option=comjsjobs" Date: 2019-08-16 Exploit Author: qw3rTyTy Vendor Homepage: https://www.joomsky.com/ Software Link: https://www.joomsky.com/5/download/1 Version: 1.2.6 Tested on: Debian/nginx/joomla...

curl security and bug fix update

7.29.0-54.0.1 - Security Fixes OraBug: 28939992 - CVE-2016-8615 cookie injection for other servers https://curl.haxx.se/docs/CVE-2016-8615.html - CVE-2016-8616 case insensitive password comparison https://curl.haxx.se/docs/CVE-2016-8616.html - CVE-2016-8617 OOB write via unchecked multiplication...

RHEL 7 : curl (RHSA-2019:2181)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2181 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, a...

SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2019:2009-1)

This update for curl fixes the following issues : Security issue fixed : CVE-2019-5436: Fixed a heap buffer overflow in tftpreceivepacket bsc1135170. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

Oracle Linux 7 : curl (ELSA-2019-1880)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-1880 advisory. - CVE-2016-8615 cookie injection for other servers https://curl.haxx.se/docs/CVE-2016-8615.html - CVE-2016-8616 case insensitive password comparison...

NewStart CGSL CORE 5.04 / MAIN 5.04 : curl Multiple Vulnerabilities (NS-SA-2019-0039)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has curl packages installed that are affected by multiple vulnerabilities: - curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl...

Joomla JS Support Ticket 1.1.6 Arbitrary File Deletion

Exploit Title: Joomla! component comjssupportticket - Authenticated Arbitrary File Deletion Dork: inurl:"index.php?option=comjssupportticket" Date: 10.08.19 Exploit Author: qw3rTyTy Vendor Homepage: https://www.joomsky.com/ Software Link: https://www.joomsky.com/46/download/1.html Version: 1.1.6...

Scientific Linux Security Update : curl on SL7.x x86_64 (20190729)

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes : - curl: NTLM password overflow via integer overflow CVE-2018-14618 For more details about the security issues, including t...

RHEL 7 : curl (RHSA-2019:1880)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1880 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, a...

CentOS 7 : curl (CESA-2019:1880)

An update for curl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE li...