USN-3498-2: curl vulnerability

USN-3498-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: It was discovered that curl incorrectly handled FTP wildcard matching. A remote attacker could use this issue to cause curl to crash, resulting in a denial of...

SUSE SLES11 Security Update : curl (SUSE-SU-2017:3176-1)

This update for curl fixes the following security issues : - CVE-2017-1000254: FTP PWD response parser out of bounds read bsc1061876 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically...

SUSE-SU-2017:3176-1 Security update for curl

This update for curl fixes the following security issues: - CVE-2017-1000254: FTP PWD response parser out of bounds read bsc1061876...

Haxx curl and libcurl out-of-bounds read denial of service vulnerability

Haxx curl and libcurl are both products of the Swedish company Haxx. curl is a set of file transfer tools that utilize URL syntax to work at the command line. libcurl is a free, open source client-side URL transfer library. An out-of-bounds read denial of service vulnerability exists in Haxx curl...

Security fix for the ALT Linux 8 package curl version 7.57.0-alt1

Dec. 1, 2017 Anton Farygin 7.57.0-alt1 - new version - fixes: CVE-2017-8818 SSL out of buffer access CVE-2017-8817 FTP wildcard out of bounds read CVE-2017-8816 NTLM buffer overflow via integer overflow...

EulerOS 2.0 SP1 : curl (EulerOS-SA-2017-1312)

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A buffer overrun flaw was found in the IMAP handler of libcurl. By tricking an unsuspecting user into connecting to a malicious IMAP server, an...

EulerOS 2.0 SP2 : curl (EulerOS-SA-2017-1313)

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A buffer overrun flaw was found in the IMAP handler of libcurl. By tricking an unsuspecting user into connecting to a malicious IMAP server, an...

EulerOS 2.0 SP2 : curl (EulerOS-SA-2017-1288)

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in anonymous or not,...

[SECURITY] [DLA 1195-1] curl security update

Package : curl Version : 7.26.0-1+wheezy23 CVE ID : CVE-2017-8817 CVE-2017-8817 Fuzzing by the OSS-Fuzz project led to the discovery of a read out of bounds flaw in the FTP wildcard function in libcurl. A malicious server could redirect a libcurl-based client to an URL using a wildcard pattern,...

[ASA-201711-36] lib32-curl: multiple issues

Arch Linux Security Advisory ASA-201711-36 ========================================== Severity: High Date : 2017-11-30 CVE-ID : CVE-2017-8816 CVE-2017-8817 CVE-2017-8818 Package : lib32-curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-521 Summary ======= The...

Slackware 14.0 / 14.1 / 14.2 / current : curl (SSA:2017-333-03)

New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2017-333-03. The text itself is copyrigh...

Critical Photon OS Security Update - PHSA-2017-0088

Updates of 'curl', 'glibc' packages of Photon OS have been released...

Ubuntu: Security Advisory (USN-3498-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Haxx curl and libcurl denial of service vulnerabilities

Haxx curl and libcurl are both products of the Swedish company Haxx. curl is a set of file transfer tools that utilize URL syntax to work at the command line. libcurl is a free, open source client-side URL transfer library. A denial of service vulnerability exists in the FTP wildcard function in...

Haxx curl and libcurl buffer overflow vulnerability

Haxx curl and libcurl are both products of the Swedish company Haxx. curl is a set of file transfer tools that utilize URL syntax to work at the command line. libcurl is a free, open source client-side URL transfer library. A buffer overflow vulnerability exists in the NTLM authentication feature...

Debian DSA-4051-1 : curl - security update

Two vulnerabilities were discovered in cURL, an URL transfer library. - CVE-2017-8816 Alex Nichols discovered a buffer overrun flaw in the NTLM authentication code which can be triggered on 32bit systems where an integer overflow might occur when calculating the size of a memory allocation. -...

FreeBSD : cURL -- Multiple vulnerabilities (301a01b7-d50e-11e7-ac58-b499baebfeaf)

The cURL project reports : - NTLM buffer overflow via integer overflow CVE-2017-8816libcurl contains a buffer overrun flaw in the NTLM authentication code. The internal function Curlntlmcoremkntlmv2hash sums up the lengths of the user name + password = SUM and multiplies the sum by two = SIZE to...

Ubuntu 14.04 LTS / 16.04 LTS : curl vulnerabilities (USN-3498-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3498-1 advisory. Alex Nichols discovered that curl incorrectly handled NTLM authentication credentials. A remote attacker could use this issue to cause curl t...

[slackware-security] curl

New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/curl-7.57.0-i586-1slack14.2.txz: Upgraded. This update fixes security issues: SSL out of buffer access FTP wildcard out of...

Out-of-bounds

The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service out-of-bounds read and application crash or possibly have unspecified other impact via a string that ends with an '' character...