[SECURITY] [DSA 2824-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2824-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso December 19, 2013 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2824-1 (curl - unchecked tls/ssl certificate host name)

Marc Deslauriers discovered that curl, a file retrieval tool, would mistakenly skip verifying the CN and SAN name fields when digital signature verification was disabled in the libcurl GnuTLS backend. The default configuration for the curl package is not affected by this issue since the digital...

FreeBSD : cURL library -- cert name check ignore with GnuTLS (4e1f4abc-6837-11e3-9cda-3c970e169bc2)

cURL project reports : libcurl is vulnerable to a case of missing out the checking of the certificate CN or SAN name field when the digital signature verification is turned off. libcurl offers two separate and independent options for verifying a server's TLS certificate. CURLOPTSSLVERIFYPEER and...

DSA-2824-1 curl - unchecked tls/ssl certificate host name

Bulletin has no description...

USN-2058-1: curl vulnerability

Marc Deslauriers discovered that libcurl incorrectly verified CN and SAN name fields when digital signature verification was disabled in the GnuTLS backend. When libcurl is being used in this uncommon way by specific applications, an attacker could exploit this to perform a machine-in-the-middle...

Debian: Security Advisory (DSA-2824-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu Update for curl USN-2048-1

Check for the Version of curl OpenVAS Vulnerability Test $Id: gbubuntuUSN20481.nasl 8542 2018-01-26 06:57:28Z teissa $ Ubuntu Update for curl USN-2048-1 Authors: System Generated Check Copyright: Copyright C 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you...

PHP openssl_x509_parse() Memory Corruption Vulnerability

Exploit for php platform in category dos / poc Overview: Quote from http://www.php.net "PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML." The PHP function opensslx509parse uses a helper function called...

Ubuntu: Security Advisory (USN-2048-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu Update for curl USN-2048-2

Check for the Version of curl OpenVAS Vulnerability Test $Id: gbubuntuUSN20482.nasl 8542 2018-01-26 06:57:28Z teissa $ Ubuntu Update for curl USN-2048-2 Authors: System Generated Check Copyright: Copyright C 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you...

cURL library -- cert name check ignore with GnuTLS

cURL project reports: libcurl is vulnerable to a case of missing out the checking of the certificate CN or SAN name field when the digital signature verification is turned off. libcurl offers two separate and independent options for verifying a server's TLS certificate. CURLOPTSSLVERIFYPEER and...

Ubuntu: Security Advisory (USN-2048-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Bio Basespace SDK 0.1.7 API Key Exposure

The Bio Basespace SDK 0.1.7 Ruby Gem API client code passes the APIKEY to a curl command. This exposes the api key to the shell and process table. Another user on the system could snag the api key by just monitoring the process table. Title: Bio Basespace SDK 0.1.7 Ruby Gem exposes API Key via...

[SECURITY] Fedora 20 Update: mingw-curl-7.33.0-1.fc20

cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...

Fedora 20 : mingw-curl-7.33.0-1.fc20 (2013-22046)

Update to 7.33.0 - Fixes CVE-2013-4545, RHBZ 1031429 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Telmanik CMS 1.01 Shell Upload

/ Exploit title : telmanik cms v1.01 File Upload Date : 12/12/2013 Author : JoKeRStEx Software Link : http://www.telmanik.com/open-source.php Tested On : WinXP PRO SP3 CVE : Version : 1.01 / 1 File Upload P.O.C "@".$shell; curlsetopt$dz,CURLOPTPOSTFIELDS,$jxarray; $exec=curlexec$dz;...

RedHat Piranha - Remote Security Bypass

source: https://www.securityfocus.com/bid/65587/info Red Hat Piranha is prone to a remote security bypass vulnerability. An attacker can exploit this issue to gain unauthorized access to the restricted pages of the application, this may lead to further attacks. Red Hat Piranha 0.8.6 is vulnerable...

WordPress Photosmash Shell Upload

Exploit Title: Wordpress photosmash plugins Remote File Upload Vulnerability Author: Ashiyane Digital Security Team Date: 12/08/2013 Vendor Homepage: http://smashly.net/ Software Link : http://downloads.wordpress.org/plugin/photosmash-galleries.1.0.7.zip Google dork:...

WordPress Plugin PhotoSmash Galleries - 'bwbps-uploader.php' Arbitrary File Upload

source: https://www.securityfocus.com/bid/64173/info The PhotoSmash Galleries plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because it fails to properly validate file extensions before uploading them. An attacker may leverage this...

Ubuntu 10.04 LTS / 12.04 LTS / 12.10 : curl regression (USN-2048-2)

USN-2048-1 fixed a vulnerability in curl. The security fix uncovered a bug in the curl command line tool which resulted in the --insecure -k option not working as intended. This update fixes the problem. We apologize for the inconvenience. Scott Cantor discovered that libcurl incorrectly verified...