OPENSUSE-SU-2017:3108-1 Security update for Mozilla Thunderbird

This update for Mozilla Thunderbird fixes the following issues: Security issues fixed in 52.5.0 ESR as advised in MFSA 2017-26 boo1068101: - CVE-2017-7828: Use-after-free of PressShell while restyling layout - CVE-2017-7830: Cross-origin URL information leak through Resource Timing API -...

OPENSUSE-SU-2017:3110-1 Security update for Mozilla Thunderbird

This update for Mozilla Thunderbird fixes the following issues: Security issues fixed in 52.5.0 ESR as advised in MFSA 2017-26 boo1068101: - CVE-2017-7828: Use-after-free of PressShell while restyling layout - CVE-2017-7830: Cross-origin URL information leak through Resource Timing API -...

curl, libcurl security update

CentOS Errata and Security Advisory CESA-2017:3263 An update for curl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Moderate: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

curl security update

7.29.0-42.el74.1 - fix buffer overflow while processing IMAP FETCH response CVE-2017-1000257...

Amazon Linux AMI : curl (ALAS-2017-922)

IMAP FETCH response out of bounds read : A buffer overrun flaw was found in the IMAP handler of libcurl. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the application...

[SECURITY] Fedora 27 Update: roundcubemail-1.3.3-1.fc27

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

[SECURITY] Fedora 26 Update: roundcubemail-1.3.3-1.fc26

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

Medium: curl

Issue Overview: IMAP FETCH response out of bounds read: A buffer overrun flaw was found in the IMAP handler of libcurl. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the...

[SECURITY] Fedora 27 Update: curl-7.55.1-6.fc27

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Debian DSA-4030-1 : roundcube - security update

A file disclosure vulnerability was discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers. An authenticated attacker can take advantage of this flaw to read roundcube's configuration files. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

[SECURITY] [DSA 4030-1] roundcube security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4030-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 09, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4030-1] roundcube security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4030-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 09, 2017 https://www.debian.org/security/faq -...

[ASA-201711-6] curl: information disclosure

Arch Linux Security Advisory ASA-201711-6 ========================================= Severity: Medium Date : 2017-11-02 CVE-ID : CVE-2017-1000257 Package : curl Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-467 Summary ======= The package curl before version...

[ASA-201711-8] lib32-libcurl-compat: information disclosure

Arch Linux Security Advisory ASA-201711-8 ========================================= Severity: Medium Date : 2017-11-02 CVE-ID : CVE-2017-1000257 Package : lib32-libcurl-compat Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-465 Summary ======= The package...

[ASA-201711-9] lib32-libcurl-gnutls: information disclosure

Arch Linux Security Advisory ASA-201711-9 ========================================= Severity: Medium Date : 2017-11-02 CVE-ID : CVE-2017-1000257 Package : lib32-libcurl-gnutls Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-464 Summary ======= The package...

[ASA-201711-11] libcurl-gnutls: information disclosure

Arch Linux Security Advisory ASA-201711-11 ========================================== Severity: Medium Date : 2017-11-02 CVE-ID : CVE-2017-1000257 Package : libcurl-gnutls Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-462 Summary ======= The package...

[ASA-201711-10] libcurl-compat: information disclosure

Arch Linux Security Advisory ASA-201711-10 ========================================== Severity: Medium Date : 2017-11-02 CVE-ID : CVE-2017-1000257 Package : libcurl-compat Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-463 Summary ======= The package...

[ASA-201711-7] lib32-curl: information disclosure

Arch Linux Security Advisory ASA-201711-7 ========================================= Severity: Medium Date : 2017-11-02 CVE-ID : CVE-2017-1000257 Package : lib32-curl Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-466 Summary ======= The package lib32-curl...

CVE-2017-1000257

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that non-existing data with a pointer and the size zero to the deliver-data function. libcurl's deliver-data function treats zero as a mag...