SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2016:2330-1)

This update for curl fixes the following issues: Security issues fixed : - CVE-2016-5419: TLS session resumption client cert bypass bsc991389 - CVE-2016-5420: Re-using connections with wrong client cert bsc991390 - CVE-2016-5421: use of connection struct after free bsc991391 - CVE-2016-7141: Fixe...

[SECURITY] Fedora 25 Update: curl-7.50.3-1.fc25

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

[SECURITY] [DLA 625-1] curl security update

Package : curl Version : 7.26.0-1+wheezy16 CVE ID : CVE-2016-7167 Debian Bug : 837945 It was discovered that the four four libcurl functions curlescape, curleasyescape, curlunescape and curleasyunescape accepted negative sting length inputs. For Debian 7 "Wheezy", these problems have been fixed i...

SUSE-SU-2016:2330-1 Security update for curl

This update for curl fixes the following issues: Security issues fixed: - CVE-2016-5419: TLS session resumption client cert bypass bsc991389 - CVE-2016-5420: Re-using connections with wrong client cert bsc991390 - CVE-2016-5421: use of connection struct after free bsc991391 - CVE-2016-7141: Fixed...

[slackware-security] curl

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/curl-7.50.3-i586-1slack14.2.txz: Upgraded. Fixed heap overflows in four libcurl functions: curlescape,...

Fedora Update for curl FEDORA-2016-7a2ed52d41

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : curl (SSA:2016-259-01)

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2016-259-01. The tex...

Fedora 24 : curl (2016-7a2ed52d41)

reject negative string lengths in curleasyunescape CVE-2016-7167 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

[SECURITY] Fedora 24 Update: curl-7.47.1-8.fc24

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

FreeBSD : cURL -- Escape and unescape integer overflows (b018121b-7a4b-11e6-bf52-b499baebfeaf)

The cURL project reports The four libcurl functions curlescape, curleasyescape, curlunescape and curleasyunescape perform string URL percent escaping and unescaping. They accept custom string length inputs in signed integer arguments. The provided string length arguments were not properly checked...

curl escape and unescape integer overflows

The four libcurl functions curlescape, curleasyescape, curlunescape and curleasyunescape perform string URL percent escaping and unescaping. They accept custom string length inputs in signed integer arguments. The functions having names without "easy" being the deprecated versions of the others...

CURL-CVE-2016-7167 curl escape and unescape integer overflows

The four libcurl functions curlescape, curleasyescape, curlunescape and curleasyunescape perform string URL percent escaping and unescaping. They accept custom string length inputs in signed integer arguments. The functions having names without "easy" being the deprecated versions of the others...

cURL -- Escape and unescape integer overflows

The cURL project reports The four libcurl functions curlescape, curleasyescape, curlunescape and curleasyunescape perform string URL percent escaping and unescaping. They accept custom string length inputs in signed integer arguments. The provided string length arguments were not properly checked...

Security fix for the ALT Linux 8 package curl version 7.50.3-alt1

Sept. 14, 2016 Anton Farygin 7.50.3-alt1 - new version with security fixes CVE-2016-7167...

Debian DLA-616-1 : curl security update

It was discovered that libcurl built on top of NSS Network Security Services incorrectly re-used client certificates if a certificate from file was used for one TLS connection but no certificate set for a subsequent TLS connection. For Debian 7 'Wheezy', this problem has been fixed in version...

Samsung Repair Information Disclosure

!/bin/bash for t in 4136987977..4136989977; do echo "testing ticket $t" for i in 2000000000..9999999999; do echo "testing telephone $i" p1=$echo $i | cut --characters 1-3 p2=$echo $i | cut --characters 4-6 p3=$echo $i | cut --characters 7- curl=$curl -sS -d ticketno=$t -d telephone1=$p1 -d...

UBUNTU-CVE-2016-7134

ext/curl/interface.c in PHP 7.x before 7.0.10 does not work around a libcurl integer overflow, which allows remote attackers to cause a denial of service allocation error and heap-based buffer overflow or possibly have unspecified other impact via a long string that is mishandled in a curlescape...

[SECURITY] [DLA 616-1] curl security update

Package : curl Version : 7.26.0-1+wheezy15 CVE ID : CVE-2016-7141 Debian Bug : 836918 It was discovered that libcurl built on top of NSS Network Security Services incorrectly re-used client certificates if a certificate from file was used for one TLS connection but no certificate set for a...

openSUSE Security Update : curl (openSUSE-2016-1043)

This update for curl fixes the following issues : - fixing a performance regression with FTP boo991746 - TLS session resumption client cert bypass boo991389, CVE-2016-5419 - Re-using connections with wrong client cert boo991390, CVE-2016-5420 - use of connection struct after free boo991391,...

MGASA-2016-0285 Updated curl packages fix security vulnerability

libcurl before 7.50.1 would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous...