CVE-2016-8624

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC t...

CVE-2016-8624

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC t...

CVE-2016-8624

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC t...

CVE-2016-8624

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC t...

CVE-2016-8621: Out-of-bounds Read

The curlgetdate function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short...

CVE-2016-8617: Out-of-bounds Write

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via CURLOPTUSERNAME...

CVE-2016-8624: Improper Input Validation

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC t...

Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerabilities in cURL (CVE-2016-7141 CVE-2018-1000007)

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerabilities in cURL. Vulnerability Details CVEID: CVE-2018-1000007 DESCRIPTION: cURL liburl could allow a remote attacker to obtain sensitive information, caused by a flaw when passing on custom Authorization:...

FreeBSD : curl -- SMTP send heap buffer overflow (3849e28f-8693-11e8-9610-9c5c8e75236a)

Peter Wu reports : curl might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidri...

GLSA-201807-04 : cURL: Heap-based buffer overflow

The remote host is affected by the vulnerability described in GLSA-201807-04 cURL: Heap-based buffer overflow A heap-based buffer overflow was discovered in cURLs Curlsmtpescapeeob function. Impact : An attacker could cause a Denial of Service condition or execute arbitrary code via SMTP...

Responsive Filemanager 9.13.1 Server-Side Request Forgery

Exploit Title: Responsive filemanager - SSRF Date: 29/07/2018 Exploit Author: GUIA BRAHIM FOUAD Vendor Homepage: http://responsivefilemanager.com/ Software Link: https://github.com/trippo/ResponsiveFilemanager/releases/download/v9.13.1/responsivefilemanager.zip Version: 9.13.1 Tested on: responsi...

cURL: Heap-based buffer overflow

Background A command line tool and library for transferring data with URLs. Description A heap-based buffer overflow was discovered in cURL’s Curlsmtpescapeeob function. Impact An attacker could cause a Denial of Service condition or execute arbitrary code via SMTP connections. Workaround There i...

CVE-2017-2629

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server...

Design/Logic Flaw

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server...

CVE-2017-2629

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server...

CVE-2017-2629

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server...

DEBIAN-CVE-2017-2629

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server...

ALPINE-CVE-2017-2629

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server...

CVE-2017-2629

CVE-2017-2629 affects curl and libcurl prior to 7.53.0, where the TLS Certificate Status Request (OCSP stapling) check incorrectly returns valid proof even when none is provided or the server does not support the extension. This can cause users to fail to detect a server certificate becoming inva...

CVE-2017-2629

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server...