curl: SSRF via maliciously crafted URL due to host confusion

Summary: Curl is vulnerable to SSRF due to improperly parsing the host component of the URL compared to other URL parsers and the URL living standard. POC curl -sD - -o /dev/null "http://google.com:80\@yahoo.com/" Curl makes a request to yahoo.com instead of google.com. Supporting...

Fedora Update for curl FEDORA-2019-f2a520135e

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Critical Photon OS Security Update - PHSA-2019-0177

Updates of 'fuse3', 'fuse', 'openssl', 'python2', 'kubernetes', 'curl' packages of Photon OS have been released...

USN-4129-1: curl vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Thomas Vegas discovered that curl incorrectly handled memory when using Kerberos over FTP. A remote attacker could use this issue to crash curl, resulting in a denial of service...

Medium: curl

Issue Overview: Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. CVE-2019-5482 Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. CVE-2019-5481 Affected Packages: curl Issue Correction: Run yum update curl or yum update --advisory ALAS-2019-129...

Fedora 29 : curl (2019-f2a520135e)

double free due to subsequent call of realloc CVE-2019-5481 - fix heap buffer overflow in function tftpreceivepacket CVE-2019-5482 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

[SECURITY] Fedora 29 Update: curl-7.61.1-12.fc29

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Visualizer < 3.3.1 - Blind Server-Side Request Forgery (SSRF)

This plugin suffers from a blind SSRF vulnerability in the /wp-json/visualizer/v1/upload-data endpoint. curl -i -s -X $'POST' \ -H $'Host: 192.168.158.128:8000' \ --data-binary $'"url":"http://db:3306"' \ $'http://192.168.158.128:8000/wp-json/visualizer/v1/upload-data' See the references for...

openSUSE: Security Advisory for curl (openSUSE-SU-2019:2169-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : curl (openSUSE-2019-2169)

This update for curl fixes the following issues : Security issues fixed : - CVE-2019-5481: Fixed FTP-KRB double-free during kerberos FTP data transfer bsc1149495. - CVE-2019-5482: Fixed TFTP small blocksize heap buffer overflow bsc1149496. This update was imported from the SUSE:SLE-15:Update upda...

OPENSUSE-SU-2019:2169-1 Security update for curl

This update for curl fixes the following issues: Security issues fixed: - CVE-2019-5481: Fixed FTP-KRB double-free during kerberos FTP data transfer bsc1149495. - CVE-2019-5482: Fixed TFTP small blocksize heap buffer overflow bsc1149496. This update was imported from the SUSE:SLE-15:Update update...

Security update for curl (important)

openSUSE Security Update: Security update for curl Announcement ID: openSUSE-SU-2019:2169-1 Rating: important References: 1149495 1149496 Cross-References: CVE-2019-5481 CVE-2019-5482 Affected Products: openSUSE Leap 15.0 An update that fixes two vulnerabilities is now available. Description: Thi...

EulerOS 2.0 SP3 : curl (EulerOS-SA-2019-2054)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.CVE-2019-54...

curl:curl_fuzzer_http: Use-of-uninitialized-value in Curl_rand_hex

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5638014398627840 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerhttp Job Type: libfuzzermsancurl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

[SECURITY] Fedora 31 Update: curl-7.66.0-1.fc31

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

[SECURITY] Fedora 30 Update: curl-7.65.3-4.fc30

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Fedora Update for curl FEDORA-2019-9e6357d82f

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 30 : curl (2019-9e6357d82f)

double free due to subsequent call of realloc CVE-2019-5481 - fix heap buffer overflow in function tftpreceivepacket CVE-2019-5482 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

openSUSE Security Update : curl (openSUSE-2019-2149)

This update for curl fixes the following issues : Security issues fixed : - CVE-2019-5481: Fixed FTP-KRB double-free during kerberos FTP data transfer bsc1149495. - CVE-2019-5482: Fixed TFTP small blocksize heap buffer overflow bsc1149496. This update was imported from the SUSE:SLE-15:Update upda...

Social Metrics Tracker <= 1.6.8 - Unauthorised Data Export

The lack of proper authorisation when exporting data from the plugin could allow unauthenticated users to get information about the posts and page of the blog, including their author's username and email. The plugin is still affected and has been closed. curl...