USN-3993-1: curl vulnerabilities

Wenchao Li discovered that curl incorrectly handled memory in the curlurlset function. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 19.04. CVE-2019-5435 It was discovered that...

USN-3993-1 curl vulnerabilities

Wenchao Li discovered that curl incorrectly handled memory in the curlurlset function. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 19.04. CVE-2019-5435 It was discovered that...

CVE-2019-5435

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1...

Integer overflows in URL parser

libcurl contains two integer overflows in the curlurlset function that if triggered, can lead to a too small buffer allocation and a subsequent heap buffer overflow. The flaws only exist on 32-bit architectures and require excessive string input lengths...

curl -- multiple vulnerabilities

curl security problems: CVE-2019-5435: Integer overflows in curlurlset libcurl contains two integer overflows in the curlurlset function that if triggered, can lead to a too small buffer allocation and a subsequent heap buffer overflow. The flaws only exist on 32 bit architectures and require...

Buffer Overflow

curl is vulnerable to buffer overflow vulnerability. The vulnerability occurs when doing a large floating point output in libcurl's implementation of the printf functions. The application accepts input format strings without doing a necessary input filtering. A remote attacker could send a format...

Denial Of Service (DoS)

curl is vulnerable to denial of service DoS attacks. This is because the libcurl does not safely parse FTP URLs when using the CURLOPTFTPFILEMETHOD method. An attacker could send a specially crafted FTP URL to an application could write a NULL byte at an arbitrary location resulting in an...

SUSE SLED15 / SLES15 Security Update : cf-cli (SUSE-SU-2019:1220-1)

"This update for cf-cli fixes the following issues : cf-cli was updated: to version 6.43.0 bsc1132242 Enhancements : cf curl supports a new --fail flag primarily for scripting purposes which returns exit code 22 for server errors story Improves cf delete-orphaned-routes such that it uses a...

About the security content of macOS High Sierra 10.13.4, Security Update 2018-002 Sierra, and Security Update 2018-002 El Capitan - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

EulerOS Virtualization 3.0.1.0 : curl (EulerOS-SA-2019-1550)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that...

Security Bulletin: IBM MQ Advanced Cloud Pak is vulnerable to a buffer overflow in the curl command (CVE-2018-16842)

Summary A vulnerability was identified in cURL that could allow a remote attacker to obtain sensitive information. cURL is included in the IBM MQ Advanced CloudPak for IBM Cloud Private on RedHat OpenShift. Vulnerability Details CVEID: CVE-2018-16842 DESCRIPTION: cURL could allow a remote attacke...

The vulnerability of the ntlmdecode_type2_target function in the libcurl library, which allows a hacker to cause a service failure

The vulnerability of the ntlmDecodeType2target function lib/vauth/ntlm.c in the curl library is caused by a numerical overflow. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Fedora Update for curl FEDORA-2018-7785911c9e

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora Update for curl FEDORA-2019-43489941ff

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora Update for curl FEDORA-2019-427a0ba9e3

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : curl (openSUSE-2019-1311)

This update for curl fixes the following issues : Security issue fixed : - CVE-2018-16839: Fixed a buffer overflow in the SASL authentication code bsc1112758. This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Session Hijacking

curl and libcurl are vulnerable to session hijacking. A remote user may be able to access data sent via a re-used TLS connection with the wrong or missing client certificate. The affected component is TLS Connection Handler...

CRLF Injection

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. It was found that the libcurl library did not correctly handle partial literal IP addresses when parsing received HTTP cookies. An attacker...

CVE-2019-9804

In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the execution of unintended additional bash script commands if the URL was maliciously crafted. This is the result of an issue with the native version of Bash o...

CVE-2019-9804

In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the execution of unintended additional bash script commands if the URL was maliciously crafted. This is the result of an issue with the native version of Bash o...