[ASA-201801-22] lib32-curl: multiple issues

Arch Linux Security Advisory ASA-201801-22 ========================================== Severity: Medium Date : 2018-01-29 CVE-ID : CVE-2018-1000005 CVE-2018-1000007 Package : lib32-curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-594 Summary ======= The package...

SUSE SLES11 Security Update : curl (SUSE-SU-2018:0230-1)

This update for curl several issues. This security issue was fixed : - CVE-2018-1000007: Prevent leaking authentication data to third parties when following redirects bsc1077001 The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has...

Debian DSA-4098-1 : curl - security update

Two vulnerabilities were discovered in cURL, an URL transfer library. - CVE-2018-1000005 Zhouyihai Ding discovered an out-of-bounds read in the code handling HTTP/2 trailers. This issue doesn't affect the oldstable distribution jessie. - CVE-2018-1000007 Craig de Stigter discovered that...

FreeBSD : cURL -- Multiple vulnerabilities (0cbf0fa6-dcb7-469c-b87a-f94cffd94583)

The cURL project reports : libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X...

[ASA-201801-20] curl: multiple issues

Arch Linux Security Advisory ASA-201801-20 ========================================== Severity: Medium Date : 2018-01-28 CVE-ID : CVE-2018-1000005 CVE-2018-1000007 Package : curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-593 Summary ======= The package curl...

[SECURITY] [DSA 4098-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4098-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini January 26, 2018 https://www.debian.org/security/faq -...

SUSE-SU-2018:0230-1 Security update for curl

This update for curl several issues. This security issue was fixed: - CVE-2018-1000007: Prevent leaking authentication data to third parties when following redirects bsc1077001 This non-security issue was fixed: - Set DEFAULTSUSE as the default cipher list bsc1027712...

SUSE-SU-2018:0217-1 Security update for curl

This update for curl fixes one issues. This security issue was fixed: - CVE-2018-1000007: Prevent leaking authentication data to third parties when following redirects bsc1077001...

SUSE-SU-2018:0214-1 Security update for curl

This update for curl fixes several issues. These security issues were fixed: - CVE-2017-1000254: Fix FTP PWD response parser out of bounds read bsc1061876. - CVE-2018-1000007: Prevent leaking authentication data to third parties when following redirects bsc1077001 Also the following adjustment wa...

[slackware-security] curl

New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/curl-7.58.0-i586-1slack14.2.txz: Upgraded. This update fixes security issues: HTTP authentication leak in redirects HTTP/2...

SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2018:0217-1)

This update for curl fixes one issues. This security issue was fixed : - CVE-2018-1000007: Prevent leaking authentication data to third parties when following redirects bsc1077001 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...

Debian: Security Advisory (DSA-4098-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Slackware 14.0 / 14.1 / 14.2 / current : curl (SSA:2018-024-01)

New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2018-024-01. The text itself is copyright C Slackware Linux,...

CVE-2018-1000007

It was found that curl and libcurl might send their Authentication header to a third party HTTP server upon receiving an HTTP REDIRECT reply. This could leak authentication token to external entities. Mitigation By default, curl and libcurl will not follow redirect requests. This flaw happens onl...

HTTP authentication leak in redirects

curl might leak authentication data to third parties. When asked to send custom headers in its HTTP requests, curl sends that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the...

Security fix for the ALT Linux 8 package curl version 7.58.0-alt1

Jan. 24, 2018 Anton Farygin 7.58.0-alt1 - new version - fixes: CVE-2018-1000005 HTTP/2 trailer out-of-bounds read CVE-2018-1000007 HTTP authentication leak in redirects...

The vulnerability of the sendto function in the software tool for interacting with servers via curl allows a hacker to trigger a service failure or redirect traffic.

The vulnerability of the sendto function in the curl programming interface relates to reading beyond the buffer limit when using the TFTP protocol. Exploiting this vulnerability allows a malicious actor to cause service failures or redirect traffic through a specially crafted URL address...

The vulnerability of the syntax analyzer of the software tool for interacting with the curl server allows a hacker to perform read operations beyond the buffer in memory.

The vulnerability of the software tool’s syntax analyzer for interacting with servers using curl is related to an error during registration on the server using the FTP protocol. Exploiting this vulnerability allows a malicious actor to gain access to data beyond the boundaries of the allocated...

macOS 10.13.x < 10.13.3 Multiple Vulnerabilities

The remote host is running a version of Mac OS X that is 10.13.x prior to 10.13.3. It is, therefore, affected by multiple vulnerabilities in the following components : - Audio - curl - IOHIDFamily - Kernel - LinkPresentation - QuartzCore - Sandbox - Security - WebKit - Wi-Fi Note that successful...

cURL/libcURL CVE-2018-1000007 Information Disclosure Vulnerability

Description cURL/libcURL is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. curl 6.0 through 7.57.0 are vulnerable. Technologies Affected Haxx Curl 6.0 Haxx Curl 6.1 Haxx Curl 6.4 Haxx Cu...