CVE-2018-1000301

curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have...

Fedora 27 : curl (2018-9dc7338487)

fix FTP shutdown response buffer overflow CVE-2018-1000300 - fix RTSP bad headers buffer over-read CVE-2018-1000301 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and...

[SECURITY] Fedora 27 Update: curl-7.55.1-11.fc27

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

openSUSE Security Update : curl (openSUSE-2018-471)

This update for curl fixes several issues : Security issues fixed : - CVE-2018-1000301: Fixed a RTSP bad headers buffer over-read could crash the curl client bsc1092098 Non security issues fixed : - If the DEFAULTSUSE cipher list is not available use the HIGH cipher alias before failing. bsc10868...

Security update for curl (moderate)

This update for curl fixes several issues: Security issues fixed: - CVE-2018-1000301: Fixed a RTSP bad headers buffer over-read could crash the curl client bsc1092098 Non security issues fixed: - If the DEFAULTSUSE cipher list is not available use the HIGH cipher alias before failing. bsc1086825...

Debian DSA-4202-1 : curl - security update

OSS-fuzz, assisted by Max Dymond, discovered that cURL, an URL transfer library, could be tricked into reading data beyond the end of a heap based buffer when parsing invalid headers in an RTSP response. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

[ASA-201805-17] libcurl-compat: multiple issues

Arch Linux Security Advisory ASA-201805-17 ========================================== Severity: Critical Date : 2018-05-18 CVE-ID : CVE-2018-1000300 CVE-2018-1000301 Package : libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-698 Summary ======= The...

SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2018:1327-1)

This update for curl fixes several issues: Security issues fixed : - CVE-2018-1000301: Fixed a RTSP bad headers buffer over-read could crash the curl client bsc1092098 Non security issues fixed : - If the DEFAULTSUSE cipher list is not available use the HIGH cipher alias before failing. bsc108682...

[ASA-201805-16] lib32-libcurl-gnutls: multiple issues

Arch Linux Security Advisory ASA-201805-16 ========================================== Severity: Critical Date : 2018-05-18 CVE-ID : CVE-2018-1000300 CVE-2018-1000301 Package : lib32-libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-697 Summary ======= Th...

SUSE-SU-2018:1327-1 Security update for curl

This update for curl fixes several issues: Security issues fixed: - CVE-2018-1000301: Fixed a RTSP bad headers buffer over-read could crash the curl client bsc1092098 Non security issues fixed: - If the DEFAULTSUSE cipher list is not available use the HIGH cipher alias before failing. bsc1086825...

[slackware-security] curl

New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/curl-7.60.0-i586-1slack14.2.txz: Upgraded. This release contains security fixes: FTP: shutdown response buffer overflow RTS...

FreeBSD : cURL -- multiple vulnerabilities (04fe6c8d-2a34-4009-a81e-e7a7e759b5d2)

cURL security problems : CVE-2018-1000300: FTP shutdown response buffer overflow curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies. When doing FTP transfers, curl keeps a spare 'closure handle' around internally that will be...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : curl vulnerabilities (USN-3648-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3648-1 advisory. Dario Weisser discovered that curl incorrectly handled long FTP server command replies. If a user or automated system were tricke...

SUSE SLES11 Security Update : curl (SUSE-SU-2018:1323-1)

This update for curl fixes the following issues: curl was updated to version 7.37.0 fate325339 bsc1084137 This update syncs the curl version to the one in SUSE Linux Enterprise 12 and is full binary compatible to the previous version. This update is done to allow other third-party software like '...

Ubuntu: Security Advisory (USN-3648-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3648-1 curl vulnerabilities

Dario Weisser discovered that curl incorrectly handled long FTP server command replies. If a user or automated system were tricked into connecting to a malicious FTP server, a remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute...

USN-3648-1: curl vulnerabilities

Dario Weisser discovered that curl incorrectly handled long FTP server command replies. If a user or automated system were tricked into connecting to a malicious FTP server, a remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute...

CURL-CVE-2018-1000301 RTSP bad headers buffer over-read

curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded content. When servers send RTSP responses back to curl, the data starts out with a set of headers. curl parses that data to separate it into a number of headers to deal with those appropriately an...

CVE-2018-1000301

curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have...

Security fix for the ALT Linux 8 package curl version 7.60.0-alt1

May 16, 2018 Anton Farygin 7.60.0-alt1 - 7.60.0 - fixes: CVE-2018-1000300 FTP shutdown response buffer overflow CVE-2018-1000301 RTSP bad headers buffer over-read...