Security fix for the ALT Linux 8 package curl version 7.59.0-alt1

March 31, 2018 Anton Farygin 7.59.0-alt1 - new version - fixes: CVE-2018-1000120 FTP path trickery leads to NIL byte out of bounds write CVE-2018-1000121 LDAP NULL pointer dereference CVE-2018-1000122 RTSP RTP buffer over-read...

[SECURITY] Fedora 28 Update: curl-7.59.0-2.fc28

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

openSUSE Security Update : curl (openSUSE-2018-299)

This update for curl fixes the following issues : Following security issues were fixed : - CVE-2018-1000120: A buffer overflow exists in the FTP URL handling that allowed an attacker to cause a denial of service or possible code execution bsc1084521. - CVE-2018-1000121: A NULL pointer dereference...

Debian: Security Advisory (DLA-1309-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

curl/curl_fuzzer_rtsp: Heap-buffer-overflow in rtsp_rtp_readwrite

Project: https://github.com/curl/curl.git Detailed report: https://oss-fuzz.com/testcase?key=6722246199476224 Project: curl Fuzzer: aflcurlfuzzerrtsp Fuzz target binary: curlfuzzerrtsp Job Type: aflasancurl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x629000009214...

SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2018:0769-1)

This update for curl fixes the following issues: Following security issues were fixed : - CVE-2018-1000120: A buffer overflow exists in the FTP URL handling that allowed an attacker to cause a denial of service or possible code execution bsc1084521. - CVE-2018-1000121: A NULL pointer dereference...

SUSE-SU-2018:0769-1 Security update for curl

This update for curl fixes the following issues: Following security issues were fixed: - CVE-2018-1000120: A buffer overflow exists in the FTP URL handling that allowed an attacker to cause a denial of service or possible code execution bsc1084521. - CVE-2018-1000121: A NULL pointer dereference...

Fedora 26 : curl (2018-66c96e0024)

fix FTP path trickery leads to NIL byte out of bounds write CVE-2018-1000120 - fix LDAP NULL pointer dereference CVE-2018-1000121 - fix RTSP RTP buffer over-read CVE-2018-1000122 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...

Fedora 27 : curl (2018-8877b4ccac)

fix FTP path trickery leads to NIL byte out of bounds write CVE-2018-1000120 - fix LDAP NULL pointer dereference CVE-2018-1000121 - fix RTSP RTP buffer over-read CVE-2018-1000122 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...

Fedora Update for curl FEDORA-2018-66c96e0024

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 27 Update: curl-7.55.1-10.fc27

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

[SECURITY] Fedora 26 Update: curl-7.53.1-16.fc26

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Debian DLA-1309-1 : curl security update

Multiple vulnerabilities were found in cURL, an URL transfer library : CVE-2018-1000120 Duy Phan Thanh reported that curl could be fooled into writing a zero byte out of bounds when curl was told to work on an FTP URL, with the setting to only issue a single CWD command. The issue could be...

[ASA-201803-16] lib32-curl: multiple issues

Arch Linux Security Advisory ASA-201803-16 ========================================== Severity: Medium Date : 2018-03-19 CVE-ID : CVE-2018-1000120 CVE-2018-1000121 CVE-2018-1000122 Package : lib32-curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-654 Summary =====...

[ASA-201803-15] curl: multiple issues

Arch Linux Security Advisory ASA-201803-15 ========================================== Severity: Medium Date : 2018-03-19 CVE-ID : CVE-2018-1000120 CVE-2018-1000121 CVE-2018-1000122 Package : curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-653 Summary ======= The...

[SECURITY] [DLA 1309-1] curl security update

Package : curl Version : 7.26.0-1+wheezy25 CVE ID : CVE-2018-1000120 CVE-2018-1000121 CVE-2018-1000122 Multiple vulnerabilities were found in cURL, an URL transfer library: CVE-2018-1000120 Duy Phan Thanh reported that curl could be fooled into writing a zero byte out of bounds when curl was told...

curl/curl_fuzzer_http: Stack-buffer-overflow in fuzz_handle_transfer

Detailed report: https://oss-fuzz.com/testcase?key=5569625854050304 Project: curl Fuzzer: libFuzzercurlfuzzerhttp Fuzz target binary: curlfuzzerhttp Job Type: libfuzzerasancurl Platform Id: linux Crash Type: Stack-buffer-overflow READ 8 Crash Address: 0x7fff6a3b0910 Crash State: fuzzhandletransfe...

[slackware-security] curl

New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/curl-7.59.0-i586-1slack14.2.txz: Upgraded. This update fixes security issues: FTP path trickery leads to NIL byte out of...

Haxx curl heap buffer overflow vulnerability

Haxx curl is a set of file transfer tools from the Swedish company Haxx that work on the command line using URL syntax, the tool supports file uploads and downloads, and includes a libcurl client-side URL transfer library for program development. A heap buffer overflow vulnerability exists in the...

Ubuntu 14.04 LTS / 16.04 LTS : curl vulnerabilities (USN-3598-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3598-1 advisory. Phan Thanh discovered that curl incorrectly handled certain FTP paths. An attacker could use this to cause a denial of service or possibly...