CVE-2014-1263

CVE-2014-1263 affects curl/libcurl 7.27.0–7.35.0 when using the SecureTransport/Darwinssl backend on macOS (OS X 10.9.x before 10.9.2). The flaw disables hostname verification for certificates when connecting to URLs that use IP addresses, allowing MITM attackers to spoof servers with arbitrary v...

CVE-2014-1263

curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a...

CVE-2014-1263

curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a...

Medium: curl

Issue Overview: cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request. Affected Packages: curl Issue Correction: Run yum update curl or yum...

cURL/libcURL NTLM连接远程安全限制绕过漏洞

BUGTRAQ ID: 65270 CVECAN ID: CVE-2014-0015 cURL是命令行传输文件工具，支持FTP、FTPS、HTTP、HTTPS、GOPHER、TELNET、DICT、FILE和LDAP。 cURL/libcURL 7.10.6- 7.34.0版本，启用了多个身份验证方法后，会重新使用NTLM连接，这可使上下文独立的攻击者通过特制的请求验证为其他用户身份。 0 cURL cURL 7.10.6 - 7.34.0 厂商补丁： cURL ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://curl.haxx.se/...

Ubuntu: Security Advisory (USN-2097-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 20 : curl-7.32.0-4.fc20 (2014-1876)

re-use of wrong HTTP NTLM connection in libcurl CVE-2014-0015 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

DEBIAN-CVE-2014-0015

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request...

CVE-2014-0015

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request...

Cross site request forgery (csrf)

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request...

Debian DSA-2849-1 : curl - information disclosure

Paras Sethia discovered that libcurl, a client-side URL transfer library, would sometimes mix up multiple HTTP and HTTPS connections with NTLM authentication to the same server, sending requests for one user over the connection authenticated as a different user. %NASLMINLEVEL 70300 C Tenable...

CVE-2014-0015

The CVE-2014-0015 issue affects curl/libcurl 7.10.6–7.34.0, where NTLM connections are reused when multiple authentication methods are enabled, potentially allowing a context-dependent attacker to authenticate as another user via a request. The F5 advisory family (e.g., K15862) mirrors this vulne...

CVE-2014-0015

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request...

SuSE 11.2 / 11.3 Security Update : curl (SAT Patch Numbers 8796 / 8797)

This update fixes the re-use of wrong HTTP NTLM connections in libcurl. CVE-2014-0015 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C Novell, Inc...

CVE-2014-0015

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request...

[SECURITY] [DSA 2849-1] curl security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2849-1 [email protected] http://www.debian.org/security/ Florian Weimer January 31, 2014 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2849-1 (curl - information disclosure)

Paras Sethia discovered that libcurl, a client-side URL transfer library, would sometimes mix up multiple HTTP and HTTPS connections with NTLM authentication to the same server, sending requests for one user over the connection authenticated as a different user. OpenVAS Vulnerability Test $Id:...

DSA-2849-1 curl - information disclosure

Bulletin has no description...

CVE-2014-0015

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request...

Debian: Security Advisory (DSA-2849-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...