12804 matches found
CVE-2024-7264 vulnerabilities
Vulnerabilities for packages: curl...
CVE-2024-7264 vulnerabilities
Vulnerabilities for packages: curl...
PT-2024-38272 · Unknown · Youdiancms
Name of the Vulnerable Software and Affected Versions: YouDianCMS version 7 Description: A critical issue has been found, affecting the curl exec function in the file /App/Core/Extend/Function/ydLib.php. The manipulation of the url argument leads to server-side request forgery. This issue can be...
curl security vulnerabilities
curl is a cURL open source tool for transferring data from or to a server. A security vulnerability exists in curl, which stems from the fact that given a syntactically incorrect field, the contents of the heap may be returned to the application or cause a crash...
Tenable Nessus Network Monitor < 6.4.0 Multiple Vulnerabilities (TNS-2024-07)
Tenable Nessus Network Monitor is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
UBUNTU-CVE-2024-7264
libcurl's ASN1 parser code has the GTime2str function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the time fraction, leading to a strlen getting performed on a pointer to a heap buffer area that i...
[SECURITY] Fedora 40 Update: curl-8.6.0-9.fc40
curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...
OPENSUSE-SU-2024:14225-1 curl-8.9.0-1.1 on GA media
These are all security issues fixed in the curl-8.9.0-1.1 package on the GA media of openSUSE Tumbleweed...
Fedora 40 : curl (2024-a7976ba89f)
The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-a7976ba89f advisory. - fix freeing stack buffer in utf8asn1str CVE-2024-6197 Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...
Security Bulletin: IBM Cloud Pak for Data is vulnerable to denial of service due to cURL libcurl ( CVE-2022-32208, CVE-2022-32206 )
Summary cURL libcurl is used by IBM Cloud Pak for Data as part of the platform. CVE-2022-32208, CVE-2022-32206. Vulnerability Details CVEID:CVE-2022-32208 DESCRIPTION: cURL libcurl is vulnerable to a man-in-the-middle attack, caused by a flaw in the handling of message verification failures. An...
macOS 14.x < 14.6 Multiple Vulnerabilities (HT214119)
The remote host is running a version of macOS / Mac OS X that is 14.x prior to 14.6. It is, therefore, affected by multiple vulnerabilities: - A race condition was addressed with improved locking. This issue is fixed in macOS Ventura 13.3. An app may bypass Gatekeeper checks. CVE-2023-27952 -...
About the security content of macOS Sonoma 14.6
About the security content of macOS Sonoma 14.6 This document describes the security content of macOS Sonoma 14.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases ar...
SUSE CVE-2024-6874
libcurl's URL API function curlurlget offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the macidn IDN backend. The conversion function then fills up the provided buffer exact...
CVE-2024-6874
A buffer overread vulnerability was found in Curl's URL API function curlurlget. This issue allows a remote attacker to obtain sensitive information due to a punycode buffer overread flaw. By sending a specially crafted request, an attacker can gain sensitive information and potentially launch...
CVE-2024-6197
A vulnerability was found in cURL's utf8asn1str function in the ASN1 parser, which causes a denial of service due to a memory allocation flaw. This flaw allows a remote attacker to use a specially crafted TLS certificate, causing the function to invoke free on a 4-byte local stack buffer. While...
AZL-47046 CVE-2024-6874 affecting package curl for versions less than 8.8.0-1
libcurl's URL API function curlurlget offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the macidn IDN backend. The conversion function then fills up the provided buffer exact...
AZL-47020 CVE-2024-6874 affecting package curl for versions less than 8.8.0-1
libcurl's URL API function curlurlget offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the macidn IDN backend. The conversion function then fills up the provided buffer exact...
AZL-47023 CVE-2024-6197 affecting package curl for versions less than 8.8.0-2
libcurl's ASN1 parser has this utf8asn1str function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes free on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort...
AZL-49664 CVE-2024-6874 affecting package cmake for versions less than 3.30.3-2
libcurl's URL API function curlurlget offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the macidn IDN backend. The conversion function then fills up the provided buffer exact...
freeing stack buffer in utf8asn1str
libcurl's ASN1 parser has this utf8asn1str function used for parsing an ASN.1 UTF-8 string. It can detect an invalid field and return error. Unfortunately, when doing so it also invokes free on a 4 byte local stack buffer. Most modern malloc implementations detect this error and immediately abort...