Photon OS 5.0: Curl PHSA-2023-5.0-91-0095

An update of the curl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0095. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2023-38039 affecting package tensorflow for versions less than 2.16.1-1

CVE-2023-38039 affecting package tensorflow for versions less than 2.16.1-1. An upgraded version of the package is available that resolves this issue...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues

Summary Multple vulnerabilities affect IBM Sterling Secure Proxy and are addressed in the latest release and iFix. Vulnerability Details CVEID:CVE-2023-41900 DESCRIPTION: Eclipse Jetty could allow a remote authenticated attacker to bypass security restrictions, caused by improper authentication...

openSUSE: Security Advisory for curl (SUSE-SU-2023:3823-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

macOS 13.x < 13.6.4 Multiple Vulnerabilities (HT214058)

The remote host is running a version of macOS / Mac OS X that is 13.x prior to 13.6.4. It is, therefore, affected by multiple vulnerabilities: - The issue was addressed with improved memory handling. This issue is fixed in watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS...

Important: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update

Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 2 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2023-38039 affecting package mysql for versions less than 8.0.35-1

CVE-2023-38039 affecting package mysql for versions less than 8.0.35-1. An upgraded version of the package is available that resolves this issue...

Oracle Database Server (October 2023 CPU)

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2023 CPU advisory. - Vulnerability in the Oracle Spatial and Graph cURL component of Oracle Database Server. Supported versions that are affected are 19.3-19.2...

KLA61542 PE vulnerability in Microsoft Mariner

An elevation of privilege vulnerability was found in Microsoft Mariner. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2023-38039 Exploitation Public exploits exist for this vulnerability. CVE list CVE-2023-38039 critical KB list Solution Install...

CVE-2023-38039 affecting package curl for versions less than 8.3.0-1

CVE-2023-38039 affecting package curl for versions less than 8.3.0-1. An upgraded version of the package is available that resolves this issue...

Important: curl

Issue Overview: HTTP headers eat all memory NOTE: https://www.openwall.com/lists/oss-security/2023/09/13/1 NOTE: https://curl.se/docs/CVE-2023-38039.html NOTE: Introduced by: https://github.com/curl/curl/commit/7c8c723682d524ac9580b9ca3b71419163cb5660 curl-7830 NOTE: Experimental tag removed in:...

Important: curl

Issue Overview: HTTP headers eat all memory NOTE: https://www.openwall.com/lists/oss-security/2023/09/13/1 NOTE: https://curl.se/docs/CVE-2023-38039.html NOTE: Introduced by: https://github.com/curl/curl/commit/7c8c723682d524ac9580b9ca3b71419163cb5660 curl-7830 NOTE: Experimental tag removed in:...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-368)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-368 advisory. HTTP headers eat all memory NOTE: https://www.openwall.com/lists/oss-security/2023/09/13/1NOTE: https://curl.se/docs/CVE-2023-38039.htmlNOTE: Introduced by:...

Fedora 37 : curl (2023-98dff7aae5)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-98dff7aae5 advisory. - fix HTTP headers eat all memory CVE-2023-38039 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

SUSE: Security Advisory (SUSE-SU-2023:3692-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES12 Security Update : curl (SUSE-SU-2023:3692-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3692-1 advisory. - CVE-2023-38039: Fixed possible DoS when receiving too large HTTP header. bsc1215026 Tenable has extracted the preceding description block...

FreeBSD : curl -- HTTP headers eat all memory (833b469b-5247-11ee-9667-080027f5fec9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 833b469b-5247-11ee-9667-080027f5fec9 advisory. - When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed lat...

Fedora 38 : curl (2023-b1253907f1)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-b1253907f1 advisory. - fix HTTP headers eat all memory CVE-2023-38039 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

CVE-2023-38039

A flaw was found in the Curl package. Curl allows a malicious server to stream an endless series of headers to a client due to missing limit on header quantity, eventually causing curl to run out of heap memory, which may lead to a crash...

CVE-2023-38039

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of header...