Fedora 24 : curl (2016-24316f1f56)

fix re-using connections with wrong client cert CVE-2016-5420 - fix TLS session resumption client cert bypass CVE-2016-5419 - fix use of connection struct after free CVE-2016-5421 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...

Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : curl (SSA:2016-219-01)

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2016-219-01. The text...

[slackware-security] curl

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/curl-7.50.1-i586-1slack14.2.txz: Upgraded. This release fixes security issues: TLS: switch off SSL sessi...

Fedora Update for curl FEDORA-2016-24316f1f56

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-3638-1 : curl - security update

Several vulnerabilities were discovered in cURL, an URL transfer library : - CVE-2016-5419 Bru Rom discovered that libcurl would attempt to resume a TLS session even if the client certificate had changed. - CVE-2016-5420 It was discovered that libcurl did not consider client certificates when...

FreeBSD : Vulnerabilities in Curl (e4bc70fc-5a2f-11e6-a1bc-589cfc0654e1)

Curl security team reports : CVE-2016-5419 - TLS session resumption client cert bypass CVE-2016-5420 - Re-using connections with wrong client cert CVE-2016-5421 - use of connection struct after free %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in th...

Debian DLA-586-1 : curl security update

CVE-2016-5419 Bru Rom discovered that libcurl would attempt to resume a TLS session even if the client certificate had changed. CVE-2016-5420 It was discovered that libcurl did not consider client certificates when reusing TLS connections. For Debian 7 'Wheezy', these problems have been fixed in...

[SECURITY] [DLA 586-1] curl security update

Package : curl Version : 7.26.0-1+wheezy14 CVE ID : CVE-2016-5419 CVE-2016-5420 CVE-2016-5419 Bru Rom discovered that libcurl would attempt to resume a TLS session even if the client certificate had changed. CVE-2016-5420 It was discovered that libcurl did not consider client certificates when...

[SECURITY] [DSA 3638-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3638-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini August 03, 2016 https://www.debian.org/security/faq -...

KLA10859 Security bypass vulnerabilities in cURL

Multiple serious vulnerabilities have been found in cURL. Malicious users can exploit these vulnerabilities to bypass security restrictions. Below is a complete list of vulnerabilities 1. Use-after-free vulnerability can be exploited to control which connection is used; 2. An improper TLS...

CVE-2016-5419

curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session...

Vulnerabilities in Curl

Curl security team reports: CVE-2016-5419 - TLS session resumption client cert bypass CVE-2016-5420 - Re-using connections with wrong client cert CVE-2016-5421 - use of connection struct after free...

CVE-2016-5420

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate...

UBUNTU-CVE-2016-5419

curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session...

Debian Security Advisory DSA 3638-1 (curl - security update)

Several vulnerabilities were discovered in cURL, an URL transfer library: CVE-2016-5419 Bru Rom discovered that libcurl would attempt to resume a TLS session even if the client certificate had changed. CVE-2016-5420 It was discovered that libcurl did not consider client certificates when reusing...

DSA-3638-1 curl - security update

Bulletin has no description...

UBUNTU-CVE-2016-5420

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate...

Debian: Security Advisory (DSA-3638-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 23 Update: php-guzzlehttp-guzzle-5.3.1-1.fc23

Guzzle is a PHP HTTP client that makes it easy to work with HTTP/1.1 and ta kes the pain out of consuming web services. Pluggable HTTP adapters that can send requests serially or in parallel Doesn't require cURL, but uses cURL by default Streams data for both uploads and downloads Provides event...

Gratipay: [gratipay.com] Cross Site Tracing

Hello team, I was checking if TRACE method is enabled on gratipay.com or not? I opened up my terminal CLI and executed this command: curl -v -X TRACE http://gratipay.com The response may not actually shows it is vulnerable, but it is not as well a message for properly configured "no" to Cross Sit...