Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : curl vulnerabilities (USN-3648-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3648-1 advisory. Dario Weisser discovered that curl incorrectly handled long FTP server command replies. If a user or automated system were tricke...

SUSE SLES11 Security Update : curl (SUSE-SU-2018:1323-1)

This update for curl fixes the following issues: curl was updated to version 7.37.0 fate325339 bsc1084137 This update syncs the curl version to the one in SUSE Linux Enterprise 12 and is full binary compatible to the previous version. This update is done to allow other third-party software like '...

Slackware 14.0 / 14.1 / 14.2 / current : curl (SSA:2018-136-01)

New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2018-136-01. The text itself is copyright C Slackware Linux,...

[SECURITY] [DSA 4202-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4202-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini May 16, 2018 https://www.debian.org/security/faq -...

SUSE-SU-2018:1323-1 Security update for curl

This update for curl fixes the following issues: curl was updated to version 7.37.0 fate325339 bsc1084137 This update syncs the curl version to the one in SUSE Linux Enterprise 12 and is full binary compatible to the previous version. This update is done to allow other third party software like '...

[SECURITY] [DLA 1379-1] curl security update

Package : curl Version : 7.26.0-1+wheezy25+deb7u1 CVE ID : CVE-2018-1000301 Debian Bug : 898856 It was discovered that there was an issue in the curl a command-line tool for downloading eg. data over HTTP. curl could have be tricked into reading data beyond the end of a heap based buffer used to...

USN-3648-1: curl vulnerabilities

Dario Weisser discovered that curl incorrectly handled long FTP server command replies. If a user or automated system were tricked into connecting to a malicious FTP server, a remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute...

Passit: `X-XSS-Protection` header has not been set at app.passit.io

Hi X-Xss-Protection at app.passit.io has not been set. Impact This header is used to configure the built in reflective XSS protection found in Internet Explorer, Chrome and Safari Webkit. Valid settings for the header are 0, which disables the protection, 1 which enables the protection and 1;...

RTSP bad headers buffer over-read

curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded content. When servers send RTSP responses back to curl, the data starts out with a set of headers. curl parses that data to separate it into a number of headers to deal with those appropriately an...

CURL-CVE-2018-1000301 RTSP bad headers buffer over-read

curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded content. When servers send RTSP responses back to curl, the data starts out with a set of headers. curl parses that data to separate it into a number of headers to deal with those appropriately an...

CVE-2018-1000301

curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have...

DSA-4202-1 curl - security update

Bulletin has no description...

CVE-2018-1000300

curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This...

Security fix for the ALT Linux 8 package curl version 7.60.0-alt1

May 16, 2018 Anton Farygin 7.60.0-alt1 - 7.60.0 - fixes: CVE-2018-1000300 FTP shutdown response buffer overflow CVE-2018-1000301 RTSP bad headers buffer over-read...

CVE-2018-1000301

curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have...

Debian: Security Advisory (DLA-1379-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2018-1000301

curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have...

UBUNTU-CVE-2018-1000300

curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This...

cURL -- multiple vulnerabilities

cURL security problems: CVE-2018-1000300: FTP shutdown response buffer overflow curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies. When doing FTP transfers, curl keeps a spare "closure handle" around internally that will be us...

Debian: Security Advisory (DSA-4202-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...