OSV-2018-40 UNKNOWN READ in ftp_disconnect

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12173 Crash type: UNKNOWN READ Crash state: ftpdisconnect Curldisconnect ConnectionExists...

cURL/libcurl 7.x < 7.51.0 Multiple Vulnerabilities

Binary data 9826.prm...

The vulnerability of the cURL library, which allows a hacker to perform authentication as another user

The vulnerability of the ConnectionExists function in the cURL library’s lib/url.c file is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to bypass authentication by acting on behalf of another user through a request...

CVE-2016-0755

The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015...