SUSE CVE-2018-1000005

libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported https://github.com/curl/curl/pull/2231 that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the...

Important: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP2 security update

Red Hat JBoss Core Services Pack Apache Server 2.4.29 Service Pack 2 packages for Microsoft Windows and Oracle Solaris are now available. Red Hat Product Security has rated this release as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

Fedora Update for curl FEDORA-2018-ba443bcb6d

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux AMI : curl (ALAS-2018-951)

Out-of-bounds read in code handling HTTP/2 trailers : libcurl contains an out bounds read in code handling HTTP/2 trailers. It was reported https://github.com/curl/curl/pull/2231 that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. Th...

Important: curl

Issue Overview: HTTP authentication leak in redirects libcurl might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and...

Fedora 27 : curl (2018-241a5a2409)

http2: fix incorrect trailer buffer size CVE-2018-1000005 - http: prevent custom Authorization headers in redirects CVE-2018-1000007 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

Fedora Update for curl FEDORA-2018-85655b12b6

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 26 : curl (2018-85655b12b6)

http2: fix incorrect trailer buffer size CVE-2018-1000005 - http: prevent custom Authorization headers in redirects CVE-2018-1000007 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

Fedora Update for curl FEDORA-2018-241a5a2409

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-4098-1 : curl - security update

Two vulnerabilities were discovered in cURL, an URL transfer library. - CVE-2018-1000005 Zhouyihai Ding discovered an out-of-bounds read in the code handling HTTP/2 trailers. This issue doesn't affect the oldstable distribution jessie. - CVE-2018-1000007 Craig de Stigter discovered that...

[SECURITY] [DSA 4098-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4098-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini January 26, 2018 https://www.debian.org/security/faq -...

[slackware-security] curl

New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/curl-7.58.0-i586-1slack14.2.txz: Upgraded. This update fixes security issues: HTTP authentication leak in redirects HTTP/2...

Debian: Security Advisory (DSA-4098-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-1000005

CVE-2018-1000005 affects libcurl 7.49.0 through 7.57.0, due to an out-of-bounds read when handling HTTP/2 trailers. Reading a trailer could corrupt future trailers, leading to a crash or potential information disclosure; the issue arises from mis-updated math after changing the header creation to...