curl, libcurl security update

CentOS Errata and Security Advisory CESA-2013:0983 Updated curl packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base...

cURL/libcURL 'curl_easy_unescape()'堆内存破坏漏洞

BUGTRAQ ID: 60737 CVECAN ID: CVE-2013-2174 cURL是命令行传输文件工具，支持FTP、FTPS、HTTP、HTTPS、GOPHER、TELNET、DICT、FILE和LDAP。 cURL 7.7 - 7.30.0版本内的函数"curleasyunescape"lib/escape.c将URL编码的字符串解码为原始二进制数据时出现边界错误，此漏洞可被利用造成堆缓冲区溢出，导致任意代码执行。 0 cURL 7.x 临时解决方法： 建议您采取以下措施以降低威胁： 升级到curl/libcurl 7.31.0 应用补丁，重建libcurl...

RHEL 5 / 6 : curl (RHSA-2013:0983)

Updated curl packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

curl: Loop counter error, leading to heap-based buffer overflow when decoding certain URLs

Heap-based buffer overflow in the curleasyunescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted string ending in a "%" percent character...

Moderate: Red Hat Security Advisory: curl security update

Updated curl packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

curl security update

7.19.7-37 - fix heap-based buffer overflow in curleasyunescape CVE-2013-2174...

Debian DSA-2713-1 : curl - heap overflow

Timo Sirainen discovered that cURL, an URL transfer library, is prone to a heap overflow vulnerability due to bad checking of the input data in the curleasyunescape function. The curl command line tool is not affected by this problem as it doesn't use the curleasyunescape function. %NASLMINLEVEL...

[SECURITY] [DSA 2713-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2713-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso June 24, 2013 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2713-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2713-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso June 24, 2013 http://www.debian.org/security/faq -...

DSA-2713-1 curl - heap overflow

Bulletin has no description...

Security fix for the ALT Linux 6 package curl version 7.24.0-alt1.M60P.1

June 24, 2013 Anton Farygin 7.24.0-alt1.M60P.1 - CVE-2013-2174 fixed curleasyunescape may parse data beyond the end of the input buffer...

Debian Security Advisory DSA 2713-1 (curl - heap overflow)

Timo Sirainen discovered that cURL, an URL transfer library, is prone to a heap overflow vulnerability due to bad checking of the input data in the curleasyunescape function. The curl command line tool is not affected by this problem as it doesn't use the curleasyunescape function. OpenVAS...

FreeBSD : cURL library -- heap corruption in curl_easy_unescape (01cf67b3-dc3b-11e2-a6cd-c48508086173)

cURL developers report : libcurl is vulnerable to a case of bad checking of the input data which may lead to heap corruption. The function curleasyunescape decodes URL-encoded strings to raw binary data. URL-encoded octets are represented with %HH combinations where HH is a two-digit hexadecimal...

ASUS RT-N66U Directory Traversal

Vulnerable product: ASUS RT-N66U when HTTPS WebService via AiCloud is enabled AC66R and RT-N65U are effected as well, but need more testing Vulnerabilities: - Linux 2.6.22 - Researched on both 3.0.0.4.270 and 3.0.0.4.354 firmware - Full directory traversal and plain text disclosure of all sensiti...

Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : curl (SSA:2013-174-01)

New curl packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2013-174-01. The tex...

CVE-2013-2174

Heap-based buffer overflow in the curleasyunescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted string ending in a "%" percent character...

Debian: Security Advisory (DSA-2713-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

cURL library -- heap corruption in curl_easy_unescape

cURL developers report: libcurl is vulnerable to a case of bad checking of the input data which may lead to heap corruption. The function curleasyunescape decodes URL-encoded strings to raw binary data. URL-encoded octets are represented with %HH combinations where HH is a two-digit hexadecimal...

Joomla Rokdownloads Shell Upload

ISlamic Republic Of Iran Security Team Www.IrIsT.Ir Exploit Title : joomla comrokdownloads Components shell upload Vulnerability Author : IrIsT Security & Researcher Team Discovered By : Am!r Home : http://IrIsT.Ir - http://IrIsT.Ir/forum Facebook Page :...

Joomla! Component com_rokdownloads - Arbitrary File Upload

Joomla! Component comrokdownloads - Arbitrary File Upload source: https://www.securityfocus.com/bid/60690/info The RokDownloads component for Joomla! is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize...