CVE-2018-1000300

Vulnerability: curl versions 7.54.1 through 7.59.0 contain a CWE-122 heap-based buffer overflow in the FTP connection shutdown path (very long server command replies), leading to potential denial of service and other impacts. Affected: curl 7.54.1–7.59.0. Root cause: heap buffer overflow during F...

CVE-2018-1000300

curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This...

CVE-2018-1000301

curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have...

CVE-2018-1000301

CVE-2018-1000301 is a curl RTSP buffer over-read vulnerability tracked across multiple advisories. The issue occurs in curl versions 7.20.0 through 7.59.0, where RTSP response parsing can leave a pointer into a buffer, causing reads beyond the end of a heap-based buffer storing downloaded content...

CVE-2018-1000301

curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have...

Fedora 27 : curl (2018-9dc7338487)

fix FTP shutdown response buffer overflow CVE-2018-1000300 - fix RTSP bad headers buffer over-read CVE-2018-1000301 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and...

Fedora Update for curl FEDORA-2018-9dc7338487

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 27 Update: curl-7.55.1-11.fc27

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Fedora Update for curl FEDORA-2018-fa01002d7e

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 28 Update: curl-7.59.0-3.fc28

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Node.js third-party modules: [statics-server] Path Traversal due to lack of provided path sanitization

Hi Team, I would like to report Path Traversal in statics-server module. It allows to read content of any arbitrary file from the server. Module module name: statics-server version: 0.0.9 npm page: https://www.npmjs.com/package/statics-server Module Description npm install statics-server -g Go to...

openSUSE Security Update : curl (openSUSE-2018-471)

This update for curl fixes several issues : Security issues fixed : - CVE-2018-1000301: Fixed a RTSP bad headers buffer over-read could crash the curl client bsc1092098 Non security issues fixed : - If the DEFAULTSUSE cipher list is not available use the HIGH cipher alias before failing. bsc10868...

openSUSE: Security Advisory for curl (openSUSE-SU-2018:1344-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for curl (moderate)

This update for curl fixes several issues: Security issues fixed: - CVE-2018-1000301: Fixed a RTSP bad headers buffer over-read could crash the curl client bsc1092098 Non security issues fixed: - If the DEFAULTSUSE cipher list is not available use the HIGH cipher alias before failing. bsc1086825...

Debian DSA-4202-1 : curl - security update

OSS-fuzz, assisted by Max Dymond, discovered that cURL, an URL transfer library, could be tricked into reading data beyond the end of a heap based buffer when parsing invalid headers in an RTSP response. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

[ASA-201805-14] lib32-curl: multiple issues

Arch Linux Security Advisory ASA-201805-14 ========================================== Severity: Critical Date : 2018-05-18 CVE-ID : CVE-2018-1000300 CVE-2018-1000301 Package : lib32-curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-695 Summary ======= The package...

SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2018:1327-1)

This update for curl fixes several issues: Security issues fixed : - CVE-2018-1000301: Fixed a RTSP bad headers buffer over-read could crash the curl client bsc1092098 Non security issues fixed : - If the DEFAULTSUSE cipher list is not available use the HIGH cipher alias before failing. bsc108682...

SUSE-SU-2018:1327-1 Security update for curl

This update for curl fixes several issues: Security issues fixed: - CVE-2018-1000301: Fixed a RTSP bad headers buffer over-read could crash the curl client bsc1092098 Non security issues fixed: - If the DEFAULTSUSE cipher list is not available use the HIGH cipher alias before failing. bsc1086825...

[ASA-201805-13] curl: multiple issues

Arch Linux Security Advisory ASA-201805-13 ========================================== Severity: Critical Date : 2018-05-17 CVE-ID : CVE-2018-1000300 CVE-2018-1000301 Package : curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-694 Summary ======= The package curl...

FreeBSD : cURL -- multiple vulnerabilities (04fe6c8d-2a34-4009-a81e-e7a7e759b5d2)

cURL security problems : CVE-2018-1000300: FTP shutdown response buffer overflow curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies. When doing FTP transfers, curl keeps a spare 'closure handle' around internally that will be...