Fedora 32 : curl (2020-7ab62c73bc)

curl: Inferior OCSP verification CVE-2020-8286 - libcurl: FTP wildcard stack overflow CVE-2020-8285 - curl: trusting FTP PASV responses CVE-2020-8284 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has...

[SECURITY] [DLA 2500-1] curl security update

Debian LTS Advisory DLA-2500-1 [email protected] https://www.debian.org/lts/security/ Roberto C. Sánchez December 18, 2020 https://wiki.debian.org/LTS Package : curl Version : 7.52.1-5+deb9u13 CVE ID : CVE-2020-8284 CVE-2020-8285 CVE-2020-8286 Debian Bug : 977161 977162 977163 Several...

Debian: Security Advisory (DLA-2500-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Virtuozzo 7 : curl / libcurl / libcurl-devel (VZLSA-2020-5002)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5002 advisory. - curl: Incorrect argument check can allow remote servers to overwrite local files CVE-2020-8177 Note that Nessus has not tested for this issue but h...

Due to use of a dangling pointer libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.

...

Command Injection

systeminformation is vulnerable to command injection. The si.inetLatency function allows an attacker to inject and execute arbitrary OS commands via curl parameters...

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port and this way potentially make curl extract information about services that are otherwise private and not disclosed for example doing port scanning and service banner extractions.

...

CVE-2020-8284 affecting package curl 7.68.0-5

CVE-2020-8284 affecting package curl 7.68.0-5. A patched version of the package is available...

CVE-2020-8286 affecting package curl 7.68.0-5

CVE-2020-8286 affecting package curl 7.68.0-5. A patched version of the package is available...

CVE-2020-8285 affecting package curl 7.68.0-5

CVE-2020-8285 affecting package curl 7.68.0-5. A patched version of the package is available...

openSUSE Security Update : curl (openSUSE-2020-2238)

This update for curl fixes the following issues : - CVE-2020-8286: Fixed improper OSCP verification in the client side bsc1179593. - CVE-2020-8285: Fixed a stack overflow due to FTP wildcard bsc1179399. - CVE-2020-8284: Fixed an issue where a malicius FTP server could make curl connect to a...

curl bug fix and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Bug Fixes and Enhancements: libcurl: Segfault when HTTPSPROXY and NOPROXY is used together BZ1900102...

Moderate: Red Hat Security Advisory: curl security and bug fix update

An update for curl is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

curl: Incorrect argument check can allow remote servers to overwrite local files

A flaw was found in curl. Overwriting local files is possible when using a certain combination of command line options. Requesting content from a malicious server could lead to overwriting local files with compromised files leading to unknown effects. The highest threat from this vulnerability is...

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

...

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

...

curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).

...

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

...

[SECURITY] Fedora 33 Update: curl-7.71.1-8.fc33

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Fedora 33 : curl (2020-ceaf490686)

curl: Inferior OCSP verification CVE-2020-8286 - libcurl: FTP wildcard stack overflow CVE-2020-8285 - curl: trusting FTP PASV responses CVE-2020-8284 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has...