UAF in SSH sha256 fingerprint check

libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the now freed hash. This flaw risks inserting sensitive heap-based data into the error message...

CURL-CVE-2023-28319 UAF in SSH sha256 fingerprint check

libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the now freed hash. This flaw risks inserting sensitive heap-based data into the error message...

CURL-CVE-2023-28320 siglongjmp race condition

libcurl provides several different backends for resolving hostnames, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm and siglongjmp. When doing this, libcurl used a global buffer that was not mutex protected a...

CURL-CVE-2023-28322 more POST-after-PUT confusion

When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. This flaw may surprise the...

CVE-2023-28322

An information disclosure vulnerability exists in curl v8.1.0 when doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request...

libcurl 资源管理错误漏洞

libcurl is a tool for transferring data from or to a server. A security vulnerability exists in libcurl that stems from allowing name resolution to timeout operations using alarm and siglongjmp, causing the application to crash...

libcurl 资源管理错误漏洞

libcurl is a tool for transferring data from or to a server. A security vulnerability exists in libcurl that stems from the fact that libcurl provides the ability to validate the public key of an SSH server using a SHA 256 hash; when this check fails, libcurl releases the memory of the fingerprin...

libcurl 安全漏洞

libcurl is a tool for transferring data from or to a server. A security vulnerability exists in libcurl that stems from a problem in the logic for reusing handles...

Security Bulletin: Multiple publicly disclosed Libcurl vulnerabilities affect IBM Safer Payments

Summary Libcurl is used by IBM Safer Payments as part of the AVRO support for Kafka. These vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2022-43551 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security restrictions, caused by a flaw when the host name i...

Moderate: Red Hat Security Advisory: curl security and bug fix update

An update for curl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

EulerOS Virtualization 2.10.1 : curl (EulerOS-SA-2023-1900)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when...

Low: curl security and bug fix update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: Incorrect handling of control code characters in cookies CVE-2022-35252 curl: Use-after-free triggered by an HTTP pro...

Moderate: curl security and bug fix update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: FTP too eager connection reuse CVE-2023-27535 For more details about the security issues, including the impact, a CVS...

ALSA-2023:3106 Moderate: curl security and bug fix update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: FTP too eager connection reuse CVE-2023-27535 For more details about the security issues, including the impact, a CVS...

Oracle Linux 9 : curl (ELSA-2023-2650)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-2650 advisory. - fix FTP too eager connection reuse CVE-2023-27535 - fix HTTP multi-header compression denial of service CVE-2023-23916 - smb/telnet: fix use-after-free when...

AlmaLinux 9 : curl (ALSA-2023:2650)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:2650 advisory. - An authentication bypass vulnerability exists in libcurl 8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during...

Siemens SINEC NMS < V1.0 SP2 Update 1 Multiple Vulnerabilities

The version of Siemens SINEC NMS installed on the remote host is prior to 1.0.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA-892048 advisory. - When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to...

Moderate: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Low: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2023-1816)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...