[SECURITY] [DLA 3398-1] curl security update

Debian LTS Advisory DLA-3398-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany April 21, 2023 https://wiki.debian.org/LTS Package : curl Version : 7.64.0-4+deb10u6 CVE ID : CVE-2023-27533 CVE-2023-27535 CVE-2023-27536 CVE-2023-27538 Several security vulnerabilitie...

Amazon Linux AMI : curl (ALAS-2023-1729)

The version of curl installed on the remote host is prior to 7.61.1-12.104. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1729 advisory. A vulnerability was found in curl. In this issue, curl can be asked to tunnel all protocols virtually it supports throug...

Amazon Linux AMI : curl (ALAS-2023-1727)

The version of curl installed on the remote host is prior to 7.61.1-12.105. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1727 advisory. The curl advisory describes this issue as follows: curl supports communicating using the TELNET protocol and as a part o...

DLA-3398-1 curl - security update

Bulletin has no description...

Medium: curl

Issue Overview: The curl advisory describes this issue as follows: curl supports communicating using the TELNET protocol and as a part of this it offers users to pass on user name and "telnet options" for the server negotiation. Due to lack of proper input scrubbing and without it being the...

CBL Mariner 2.0 Security Update: cmake / curl / mysql / rust / tensorflow (CVE-2023-27533)

The version of cmake / curl / mysql / rust / tensorflow installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-27533 advisory. - A vulnerability in input validation exists in curl 8.0 during communicatio...

Oracle MySQL Server (Apr 2023 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Packaging OpenSSL. Supported versions that are affected are 5.7.41 and...

Oracle HTTP Server (Apr 2023 CPU)

The version of Oracle HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the Apr 2023 CPU advisory. - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: SSL Module zlib . The supported version that is affected is...

RHEL 8 : curl (RHSA-2023:1842)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1842 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, a...

CBL Mariner 2.0 Security Update: cmake / curl / mysql / rust / tensorflow (CVE-2023-27536)

The version of cmake / curl / mysql / rust / tensorflow installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-27536 advisory. - An authentication bypass vulnerability exists libcurl 8.0.0 in the...

The vulnerability of the HSTS (HTTP Strict Transport Security) mechanism in the cURL command line utility allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the HSTS HTTP Strict Transport Security mechanism in the CURL command line utility is related to the transmission of critical information in plaintext when IDN symbols in host names are replaced with similar ASCII symbols. Exploiting this vulnerability can allow an unauthoriz...

GDidees CMS 3.9.1 - Local File Disclosure Vulnerability

Exploit Title: GDidees CMS 3.9.1 - Local File Disclosure Exploit Author : Hadi Mene Vendor Homepage : https://www.gdidees.eu/ Software Link : https://www.gdidees.eu/cms-1-0.html Version : 3.9.1 and earlier Tested on : Debian 11 CVE : CVE-2023-27179 Summary: GDidees CMS v3.9.1 and lower versions w...

Medium: curl

Issue Overview: A vulnerability was found in curl. In this issue, curl can be asked to tunnel all protocols virtually it supports through an HTTP proxy. HTTP proxies can deny these tunnel operations using an appropriate HTTP error response code. When getting denied to tunnel the specific SMB or...

The vulnerability of the HSTS (HTTP Strict Transport Security) mechanism in the cURL command line utility allows a attacker to alter the HSTS functionality by making successive requests to multiple URL addresses.

The vulnerability of the HSTS HTTP Strict Transport Security mechanism in the cURL command line utility is related to a problem where multiple requests may lead to HSTS support being ignored. Exploiting this vulnerability could allow a remote attacker to alter HSTS functionality when multiple URL...

CBL Mariner 2.0 Security Update: cmake / curl / mysql / rust / tensorflow (CVE-2023-27534)

The version of cmake / curl / mysql / rust / tensorflow installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-27534 advisory. - A path traversal vulnerability exists in curl 8.0.0 SFTP implementation...

CSRF bypass

Description URL parsing with Qwik uses the new URLa, b constructor. A little-known fact about this constructor is that if an attacker controls a they have complete control of the finally resolved URL. For example: const url = new URLattackervalue, "http://localhost" By entering //test.com, we can...

Oracle VM VirtualBox <6.1.44, < 7.0.8 (April 2023 CPU)

The version of VirtualBox installed on the remote host is prior to 6.144 or 7.0.8. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory: - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to denial of service and remote attack due to OpenSSL and cURL libcurl. (CVE-2022-4304, CVE-2023-0215, CVE-2023-0286 & CVE-2022-42915).

Summary ODBC Drivers in IBM App Connect Enterprise and IBM Integration Bus are vulnerable to denial of service and remote attack due to OpenSSL & cURL libcurl. CVE-2022-4304, CVE-2023-0215, CVE-2023-0286 & CVE-2022-42915. The resolving fix includes OpenSSL 1.1.1t and cURL libcurl =7.86.0...

curl: HTTP multi-header compression denial of service

A flaw was found in the Curl package. A malicious server can insert an unlimited number of compression steps. This decompression chain could result in out-of-memory errors...

Moderate: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...