Fedora Update for curl FEDORA-2013-5618

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-2660-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 18 Update: curl-7.27.0-8.fc18

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Fedora 18 : curl-7.27.0-8.fc18 (2013-5618)

fix cookie tailmatching to prevent cross-domain leakage CVE-2013-1944 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

curl / libcURL "tailmatch()" Cookie信息泄露漏洞

CVECAN ID: CVE-2013-1944 cURL是命令行传输文件工具，支持FTP、FTPS、HTTP、HTTPS、GOPHER、TELNET、DICT、FILE和LDAP。 cURL/libcURL 7.29.0及之前版本的函数"tailmatch" lib/cookie.c通过matching tail根据域名匹配cookie路径域时出错，导致泄露另一个域的cookie。 0 cURL 7.x 厂商补丁： cURL ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://curl.haxx.se/...

USN-1801-1: curl vulnerability

YAMADA Yasuharu discovered that libcurl was vulnerable to a cookie leak when doing requests across domains with matching tails. curl did not properly restrict cookies to domains and subdomains. If a user or automated system were tricked into processing a specially crafted URL, an attacker could...

CVE-2013-1944

The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL...

CURL-CVE-2013-1944 cookie domain tailmatch

libcurl is vulnerable to a cookie leak vulnerability when doing requests across domains with matching tails. When communicating over HTTPS and having libcurl's cookie engine enabled, libcurl stores and holds cookies for use when subsequent requests are done to hosts and paths that match those kep...

Apache Subversion - Remote Denial of Service

source: https://www.securityfocus.com/bid/58898/info Apache Subversion is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to crash the application, resulting in denial-of-service conditions. Apache Subversion versions 1.7.0 through 1.7.8 are vulnerable. curl -X...

Apache Subversion 1.6.x - mod_dav_svnlock.c Remote Denial of Service

Apache Subversion 1.6.x - moddavsvnlock.c Remote Denial of Service source: https://www.securityfocus.com/bid/58897/info Apache Subversion is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to crash the application, resulting in denial-of-service conditions...

Apache Subversion 1.6.x - 'mod_dav_svn/lock.c' Remote Denial of Service

source: https://www.securityfocus.com/bid/58897/info Apache Subversion is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to crash the application, resulting in denial-of-service conditions. Apache Subversion versions 1.6.0 through 1.6.20 and 1.7.0 through 1.7....

Aspen 0.8 - Directory Traversal

Exploit for multiple platform in category web applications The vulnerability happens when directory indexing is turned on default configuration in this version and a user requests, for instance localhost/../../../../../../../etc/passwd. The vulnerability may be tested with the following...

CVE-2013-2617

lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...

CVE-2013-2617

lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...

CVE-2013-2617

The CVE-2013-2617 issue affects the Ruby Curl Gem (lib/curl.rb). The vulnerability allows remote attackers to execute arbitrary commands by supplying a URL containing shell metacharacters, due to insufficient URL escaping. This is documented in multiple sources (RubyGems advisory for CVE-2013-261...

Linux Manage Download and Execute

This module downloads and runs a file with bash. It first tries to uses curl as its HTTP client and then wget if it's not found. Bash found in the PATH is used to execute the file. This module requires Metasploit: https://metasploit.com/download Current source:...

Ruby Gem Curl Command Execution Vulnerability

Ruby Gem Curl suffers from a remote command execution vulnerability due to a lack of user input sanitization. Curl Ruby Gem Remote command execution 3/12/2013 https://github.com/tg0/curl Specially crafted URLs can result in remote code execution: In ./lib/curl.rb the following lines: 131 cmd =...

CVE-2013-2617 rubygem-curl: insufficient URL escaping command injection

lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...

CVE-2013-0249

Stack-based buffer overflow in the Curlsaslcreatedigestmd5message function in lib/curlsasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long string...

DEBIAN-CVE-2013-0249

Stack-based buffer overflow in the Curlsaslcreatedigestmd5message function in lib/curlsasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long string...