CVE-2016-9586

curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks...

Node.js third-party modules: [bruteser] Path Traversal allows to read content of arbitrary file

I would like to report Path Traversal in bruteser module. It allows to read content of any arbitrary file from the server where bruteser is installed and run. Module module name: bruteser version: 0.0.2 npm page: https://www.npmjs.com/package/bruteser Module Description BruteSer - server can be...

curl/curl_fuzzer_http: Crash in http2_send

Project: https://github.com/curl/curl.git Detailed report: https://oss-fuzz.com/testcase?key=4661789242425344 Project: curl Fuzzer: libFuzzercurlfuzzerhttp Fuzz target binary: curlfuzzerhttp Job Type: libfuzzerasancurl Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x612000030000 Cras...

Amazon Linux 2 : curl (ALAS-2018-951)

HTTP authentication leak in redirects libcurl might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP...

Critical Photon OS Security Update - PHSA-2018-0124

Updates of 'curl' packages of Photon OS have been released...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2018-1.0-0124

An update of 'curl' packages of Photon OS has been released...

GLSA-201804-04 : cURL: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201804-04 cURL: Multiple vulnerabilities Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details. Impact : Remote attackers could cause a Denial of Service condition,...

cURL: Multiple vulnerabilities

Background A command line tool and library for transferring data with URLs. Description Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details. Impact Remote attackers could cause a Denial of Service condition, obtain sensitive...

USN-3598-1: curl vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Phan Thanh discovered that curl incorrectly handled certain FTP paths. An attacker could use this to cause a denial of service or possibly execute arbitrary code. CVE-2018-1000120 Dario Weisser discovered...

macOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-002)

The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components : - ATS - CFNetwork Session - CoreFoundation - CoreTypes - curl - Disk Images - iCloud Drive - Kernel - kext...

Security fix for the ALT Linux 8 package curl version 7.59.0-alt1

March 31, 2018 Anton Farygin 7.59.0-alt1 - new version - fixes: CVE-2018-1000120 FTP path trickery leads to NIL byte out of bounds write CVE-2018-1000121 LDAP NULL pointer dereference CVE-2018-1000122 RTSP RTP buffer over-read...

[SECURITY] Fedora 28 Update: curl-7.59.0-2.fc28

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

openSUSE Security Update : curl (openSUSE-2018-299)

This update for curl fixes the following issues : Following security issues were fixed : - CVE-2018-1000120: A buffer overflow exists in the FTP URL handling that allowed an attacker to cause a denial of service or possible code execution bsc1084521. - CVE-2018-1000121: A NULL pointer dereference...

Debian: Security Advisory (DLA-1309-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

curl/curl_fuzzer_rtsp: Heap-buffer-overflow in rtsp_rtp_readwrite

Project: https://github.com/curl/curl.git Detailed report: https://oss-fuzz.com/testcase?key=6722246199476224 Project: curl Fuzzer: aflcurlfuzzerrtsp Fuzz target binary: curlfuzzerrtsp Job Type: aflasancurl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x629000009214...

SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2018:0769-1)

This update for curl fixes the following issues: Following security issues were fixed : - CVE-2018-1000120: A buffer overflow exists in the FTP URL handling that allowed an attacker to cause a denial of service or possible code execution bsc1084521. - CVE-2018-1000121: A NULL pointer dereference...

SUSE-SU-2018:0769-1 Security update for curl

This update for curl fixes the following issues: Following security issues were fixed: - CVE-2018-1000120: A buffer overflow exists in the FTP URL handling that allowed an attacker to cause a denial of service or possible code execution bsc1084521. - CVE-2018-1000121: A NULL pointer dereference...

Fedora 27 : curl (2018-8877b4ccac)

fix FTP path trickery leads to NIL byte out of bounds write CVE-2018-1000120 - fix LDAP NULL pointer dereference CVE-2018-1000121 - fix RTSP RTP buffer over-read CVE-2018-1000122 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...

Fedora 26 : curl (2018-66c96e0024)

fix FTP path trickery leads to NIL byte out of bounds write CVE-2018-1000120 - fix LDAP NULL pointer dereference CVE-2018-1000121 - fix RTSP RTP buffer over-read CVE-2018-1000122 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...

Fedora Update for curl FEDORA-2018-66c96e0024

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...