Debian: Security Advisory (DLA-883-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 27 : curl (2017-e8179c06fd)

fix out of bounds read in FTP PWD response parser CVE-2017-1000254 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 27 : curl (2017-45bdf4dace)

fix NTLM buffer overflow via integer overflow CVE-2017-8816 - fix FTP wildcard out of bounds read CVE-2017-8817 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format...

Fedora 27 : curl (2017-b25c8a7087)

fix buffer overflow while processing IMAP FETCH response CVE-2017-1000257 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

curl/curl_fuzzer_ftp: Heap-buffer-overflow in loop

Project: https://github.com/curl/curl.git Detailed report: https://oss-fuzz.com/testcase?key=5917474819145728 Project: curl Fuzzer: libFuzzercurlfuzzerftp Fuzz target binary: curlfuzzerftp Job Type: libfuzzerasancurl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

Sophos XG from Unauthenticated Persistent XSS to Unauthorized Root Access(CVE-2017-18014)

Vulnerability Summary The following advisory describes an unauthenticated persistent XSS that leads to unauthorized root access found in Sophos XG version 17. Sophos XG Firewall “provides unprecedented visibility into your network, users, and applications directly from the all-new control center...

CVE-2014-4997

lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process...

CVE-2014-5000

The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process...

CVE-2014-4997

lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process...

curl/curl_fuzzer_pop3: Heap-buffer-overflow in pop3_get_message

Project: https://github.com/curl/curl.git Detailed report: https://oss-fuzz.com/testcase?key=5702643004473344 Project: curl Fuzzer: aflcurlfuzzerpop3 Fuzz target binary: curlfuzzerpop3 Job Type: aflasancurl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x629000013852...

CPP-Ethereum JSON-RPC admin_peers improper authorization Vulnerability

Summary An exploitable improper authorization vulnerability exists in adminpeers API of cpp-ethereum’s JSON-RPC commit 4e1015743b95821849d001618a7ce82c7c073768. A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigg...

Gespage 7.4.8 SQL Injection

CVE-2017-7997 Gespage SQL Injection vulnerability Description Gespage is a web solution providing a printer portal. Official Website: http://www.gespage.com/ The web application does not properly filter several parameters sent by users, allowing authenticated SQL code injection Stacked Queries -...

Gespage 7.4.8 - SQL Injection

CVE-2017-7997 Gespage SQL Injection vulnerability Description Gespage is a web solution providing a printer portal. Official Website: http://www.gespage.com/ The web application does not properly filter several parameters sent by users, allowing authenticated SQL code injection Stacked Queries -...

Amazon Linux AMI : curl (ALAS-2018-938)

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service integer overflow and resultant buffer overflow, and application crash or possibly have unspecified other impact via vectors involving long user and password fields...

Critical Photon OS Security Update - PHSA-2018-0096

Updates of 'rsync' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2018-0009

Updates of 'linux-aws', 'glibc', 'linux-secure', 'rpm', 'rsync', 'linux-esx', 'linux', 'curl' packages of Photon OS have been released...

MGASA-2018-0054 Updated curl packages fix security vulnerability

libcurl contains a buffer overrun flaw in the NTLM authentication code CVE-2017-8816. libcurl contains a read out of bounds flaw in the FTP wildcard function CVE-2017-8817. libcurl may read outside of a heap allocated buffer when doing FTP CVE-2017-1000254. libcurl contains a buffer overrun flaw ...

Updated curl packages fix security vulnerability

libcurl contains a buffer overrun flaw in the NTLM authentication code CVE-2017-8816. libcurl contains a read out of bounds flaw in the FTP wildcard function CVE-2017-8817. libcurl may read outside of a heap allocated buffer when doing FTP CVE-2017-1000254. libcurl contains a buffer overrun flaw ...

MGASA-2018-0053 Updated curl packages fix security vulnerability

If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar. The issue pertains to the function that loads cookies into memory, which reads the specified file...

Updated curl packages fix security vulnerability

If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar. The issue pertains to the function that loads cookies into memory, which reads the specified file...