USN-3710-1: curl vulnerability

Peter Wu discovered that curl incorrectly handled certain SMTP buffers. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code...

CVE-2018-0500

A heap-based buffer overflow has been found in the Curlsmtpescapeeob function of curl. An attacker could exploit this by convincing a user to use curl to upload data over SMTP with a reduced buffer to cause a crash or corrupt memory...

CURL-CVE-2018-0500 SMTP send heap buffer overflow

curl might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer. When sending data over SMTP, curl allocates a separate "scratch area" on the heap to be able to escape the uploaded data properly if the uploaded data contains data that requires it. The si...

SMTP send heap buffer overflow

curl might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer. When sending data over SMTP, curl allocates a separate "scratch area" on the heap to be able to escape the uploaded data properly if the uploaded data contains data that requires it. The si...

curl -- SMTP send heap buffer overflow

Peter Wu reports: curl might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer...

CVE-2018-0500: Out-of-bounds Write

Curlsmtpescapeeob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings i.e., use of a nonstandard --limit-rate argument or CURLOPTBUFFERSIZE...

UBUNTU-CVE-2018-0500

Curlsmtpescapeeob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings i.e., use of a nonstandard --limit-rate argument or CURLOPTBUFFERSIZE...

CVE-2018-0500

Curlsmtpescapeeob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings i.e., use of a nonstandard --limit-rate argument or CURLOPTBUFFERSIZE...

PT-2018-8862

Name of the Vulnerable Software and Affected Versions curl versions 7.54.1 through 7.60.0 Description The issue is related to a heap-based buffer overflow in the Curl smtp escape eob function when curl transmits data over SMTP with certain settings, such as a nonstandard --limit-rate argument or...

Security Bulletin: Vulnerabilities in cURL component shipped with IBM Rational ClearCase (CVE-2016-8624, CVE-2016-8625)

Summary IBM Rational ClearCase is affected by cURL/libcURL access restriction bypass and network host spoofing vulnerabilities. Vulnerability Details CVEID: CVE-2016-8624 DESCRIPTION: cURL/libcurl could allow a remote attacker to bypass security restrictions, caused by the failure to parse the...

Security Bulletin: Vulnerabilities in cURL component shipped with IBM Rational ClearCase (CVE-2017-1000100, CVE-2017-1000254, CVE-2017-1000257)

Summary IBM Rational ClearCase is affected by cURL/libcURL vulnerabilities. Vulnerability Details CVEID: CVE-2017-1000100 DESCRIPTION: cURL could allow a remote attacker to obtain sensitive information, caused by a TFTP URL processing error when doing a TFTP transfer. By redirecting a libcurl-usi...

Security Bulletin: Vulnerabilities in cURL component shipped with ClearCase (CVE-2014-0139)

Summary An attacker could send a specially-crafted certificate to impersonate a server. Vulnerability Details CVEID: CVE-2014-0139 Description: cURL/libcURL could allow a remote attacker to bypass security restrictions, caused by an error in the hostmatch function when validating certificates...

Security Bulletin: Vulnerability in cURL component shipped with IBM Rational ClearCase (CVE-2015-3153)

Summary IBM Rational ClearCase is affected by a cURL/libcURL CURLOPTHTTPHEADER information disclosure vulnerability. Vulnerability Details CVEID: CVE-2015-3153 DESCRIPTION: cURL/libcURL could allow a remote attacker to obtain sensitive information, caused by custom HTTP headers with sensitive...

Security Bulletin: Vulnerabilities in cURL component shipped with IBM Rational ClearCase (CVE-2018-1000005, CVE-2018-1000007)

Summary IBM Rational ClearCase is affected by cURL/libcURL vulnerabilities. Vulnerability Details CVEID: CVE-2018-1000007 DESCRIPTION: cURL liburl could allow a remote attacker to obtain sensitive information, caused by a flaw when passing on custom Authorization: headers. By sending a...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2018-2.0-0068

An update of 'curl' packages of Photon OS has been released...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2018-1.0-0158

An update of 'curl' packages of Photon OS has been released...

Critical Photon OS Security Update - PHSA-2018-0068

Updates of 'linux-aws', 'linux-secure', 'linux-esx', 'linux', 'curl' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2018-0158

Updates of 'curl' packages of Photon OS have been released...

Intrigue-Core - Discover Your Attack Surface

Intrigue-core is a framework for automated attack surface discovery. There are a number of use cases: Application and Infrastructure Asset Discovery Security Research and Vulnerability Discovery Malware Campaign Research & Indicator Enrichment Exploratory OSINT Research If you'd like assistance...

EulerOS 2.0 SP3 : curl (EulerOS-SA-2018-1203)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that libcurl did not safely parse FTP URLs when using the CURLOPTFTPFILEMETHOD method. An attacker, able to provide a specially craft...