66 matches found
CVE-2021-22890
curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived...
CVE-2020-8231
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data...
curl: NTLM password overflow via integer overflow
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curlntlmcoremknthash multiplies the length of the password by two SUM to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently...
CVE-2003-1605
curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server...
UBUNTU-CVE-2016-8625
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host...
CVE-2016-8624
curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC t...
Heap overflow
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have...
CVE-2018-1000300
curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This...
CVE-2018-1000301
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have...
Security fix for the ALT Linux 8 package curl version 7.60.0-alt1
May 16, 2018 Anton Farygin 7.60.0-alt1 - 7.60.0 - fixes: CVE-2018-1000300 FTP shutdown response buffer overflow CVE-2018-1000301 RTSP bad headers buffer over-read...
Security fix for the ALT Linux 8 package curl version 7.59.0-alt1
March 31, 2018 Anton Farygin 7.59.0-alt1 - new version - fixes: CVE-2018-1000120 FTP path trickery leads to NIL byte out of bounds write CVE-2018-1000121 LDAP NULL pointer dereference CVE-2018-1000122 RTSP RTP buffer over-read...
Security fix for the ALT Linux 8 package curl version 7.55.0-alt1
Aug. 9, 2017 Anton Farygin 7.55.0-alt1 - new version with following security fixes: CVE-2017-1000101 glob: do not parse after a strtoul overflow range CVE-2017-1000100 tftp: reject file name lengths that don't fit CVE-2017-1000099 file: output the correct buffer to the user...
Security fix for the ALT Linux 8 package curl version 7.52.1-alt1
Dec. 23, 2016 Anton Farygin 7.52.1-alt1 - new version with security fixes: CVE-2016-9594: uninitialized random...
cURL >= 7.21.0 and < 7.49.0 MitM Spoofing
Binary data 802007.prm...
cURL / libcURL 7.x < 7.42.1 Proxied Traffic HTTP Server Header Remote Disclosure
Binary data 8864.prm...
Security fix for the ALT Linux 8 package curl version 7.43.0-alt1
June 19, 2015 Anton Farygin 7.43.0-alt1 - new version, with fixes for CVE-2015-3236, CVE-2015-3237...
Security fix for the ALT Linux 8 package curl version 7.42.1-alt1
April 29, 2015 Anton Farygin 7.42.1-alt1 - new version, with fixes for CVE-2015-3153...
cURL / libcURL 7.x < 7.40.0 Remote Security Bypass
Binary data 8620.prm...
Information disclosure - ownCloud
Due to the inclusion of the Amazon SDK testing suite an unauthenticated attacker is able to gain additional informations about the server including: the PHP version the cURL version informations wether the following functions/modules are available: SimpleXML DOM SPL JSON PCRE File System Read/Wri...
Server: Information disclosure
Due to the inclusion of the Amazon SDK testing suite an unauthenticated attacker is able to gain additional informations about the server including: the PHP version the cURL version informations wether the following functions/modules are available: SimpleXML DOM SPL JSON PCRE File System Read/Wri...