curl:curl_fuzzer_http: Heap-use-after-free in seturl

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5168359280214016 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerhttp Job Type: libfuzzerasancurl Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x60300002cfbb Cra...

curl:curl_fuzzer_http: Heap-use-after-free in curl_dbg_strdup

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5132127439421440 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerhttp Job Type: libfuzzerasani386curl Platform Id: linux Crash Type: Heap-use-after-free READ 6 Crash Address: 0xf27039ff Cra...

curl: SSRF via maliciously crafted URL due to host confusion

Summary: Curl is vulnerable to SSRF due to improperly parsing the host component of the URL compared to other URL parsers and the URL living standard. POC curl -sD - -o /dev/null "http://google.com:80\@yahoo.com/" Curl makes a request to yahoo.com instead of google.com. Supporting...

Fedora Update for curl FEDORA-2019-f2a520135e

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Critical Photon OS Security Update - PHSA-2019-0177

Updates of 'fuse3', 'fuse', 'openssl', 'python2', 'kubernetes', 'curl' packages of Photon OS have been released...

Medium: curl

Issue Overview: Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. CVE-2019-5482 Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. CVE-2019-5481 Affected Packages: curl Issue Correction: Run yum update curl or yum update --advisory ALAS-2019-129...

USN-4129-1: curl vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Thomas Vegas discovered that curl incorrectly handled memory when using Kerberos over FTP. A remote attacker could use this issue to crash curl, resulting in a denial of service...

Fedora 29 : curl (2019-f2a520135e)

double free due to subsequent call of realloc CVE-2019-5481 - fix heap buffer overflow in function tftpreceivepacket CVE-2019-5482 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

[SECURITY] Fedora 29 Update: curl-7.61.1-12.fc29

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Visualizer < 3.3.1 - Blind Server-Side Request Forgery (SSRF)

This plugin suffers from a blind SSRF vulnerability in the /wp-json/visualizer/v1/upload-data endpoint. curl -i -s -X $'POST' \ -H $'Host: 192.168.158.128:8000' \ --data-binary $'"url":"http://db:3306"' \ $'http://192.168.158.128:8000/wp-json/visualizer/v1/upload-data' See the references for...

openSUSE: Security Advisory for curl (openSUSE-SU-2019:2169-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : curl (openSUSE-2019-2169)

This update for curl fixes the following issues : Security issues fixed : - CVE-2019-5481: Fixed FTP-KRB double-free during kerberos FTP data transfer bsc1149495. - CVE-2019-5482: Fixed TFTP small blocksize heap buffer overflow bsc1149496. This update was imported from the SUSE:SLE-15:Update upda...

OPENSUSE-SU-2019:2169-1 Security update for curl

This update for curl fixes the following issues: Security issues fixed: - CVE-2019-5481: Fixed FTP-KRB double-free during kerberos FTP data transfer bsc1149495. - CVE-2019-5482: Fixed TFTP small blocksize heap buffer overflow bsc1149496. This update was imported from the SUSE:SLE-15:Update update...

EulerOS 2.0 SP3 : curl (EulerOS-SA-2019-2054)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.CVE-2019-54...

Security update for curl (important)

openSUSE Security Update: Security update for curl Announcement ID: openSUSE-SU-2019:2169-1 Rating: important References: 1149495 1149496 Cross-References: CVE-2019-5481 CVE-2019-5482 Affected Products: openSUSE Leap 15.0 An update that fixes two vulnerabilities is now available. Description: Thi...

curl:curl_fuzzer_http: Use-of-uninitialized-value in Curl_rand_hex

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5638014398627840 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerhttp Job Type: libfuzzermsancurl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

[SECURITY] Fedora 31 Update: curl-7.66.0-1.fc31

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

[SECURITY] Fedora 30 Update: curl-7.65.3-4.fc30

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Fedora 30 : curl (2019-9e6357d82f)

double free due to subsequent call of realloc CVE-2019-5481 - fix heap buffer overflow in function tftpreceivepacket CVE-2019-5482 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

openSUSE Security Update : curl (openSUSE-2019-2149)

This update for curl fixes the following issues : Security issues fixed : - CVE-2019-5481: Fixed FTP-KRB double-free during kerberos FTP data transfer bsc1149495. - CVE-2019-5482: Fixed TFTP small blocksize heap buffer overflow bsc1149496. This update was imported from the SUSE:SLE-15:Update upda...