CVE-2017-1000254

CVE-2017-1000254 affects curl/libcurl: FTP PWD response parsing could read beyond a heap buffer due to a parser flaw when the directory name is not properly quoted. The issue causes out-of-bounds reads and potential crashes. Patches exist in curl updates (notably fixed by 7.56.0 with improved nul...

CVE-2017-1000254

libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in anonymous or not, it asks the server for the current directory with the PWD command. The server then responds with a 257 response containing the path, inside double...

CVE-2017-1000254

libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in anonymous or not, it asks the server for the current directory with the PWD command. The server then responds with a 257 response containing the path, inside double...

CVE-2017-1000254

libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in anonymous or not, it asks the server for the current directory with the PWD command. The server then responds with a 257 response containing the path, inside double...

[slackware-security] curl

New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/curl-7.56.0-i586-1slack14.2.txz: Upgraded. This update fixes a security issue: libcurl may read outside of a heap allocate...

Debian DLA-1121-1 : curl security update

It was discovered that there was a out-of-bounds read vulnerability in curl, a command-line and library for transferring data over HTTP/FTP, etc. A malicious FTP server could abuse this to prevent curl-based clients from interacting with it. See for more details. For Debian 7 'Wheezy', this issue...

[SECURITY] [DLA 1121-1] curl security update

Package : curl Version : 7.26.0-1+wheezy21 CVE ID : CVE-2017-1000254 Debian Bug : 877671 It was discovered that there was a out-of-bounds read vulnerability in curl, a command-line and library for transferring data over HTTP/FTP, etc. A malicious FTP server could abuse this to prevent curl-based...

[ASA-201710-2] curl: denial of service

Arch Linux Security Advisory ASA-201710-2 ========================================= Severity: Low Date : 2017-10-05 CVE-ID : CVE-2017-1000254 Package : curl Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-422 Summary ======= The package curl before version 7.56.0-1...

FreeBSD : cURL -- out of bounds read (ccace707-a8d8-11e7-ac58-b499baebfeaf)

The cURL project reports : FTP PWD response parser out of bounds read libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in anonymous or not, it asks the server for the current directory with the PWD command. The server...

[ASA-201710-4] lib32-libcurl-gnutls: multiple issues

Arch Linux Security Advisory ASA-201710-4 ========================================= Severity: Medium Date : 2017-10-05 CVE-ID : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000254 Package : lib32-libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-386 Summa...

CURL-CVE-2017-1000254 FTP PWD response parser out of bounds read

libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in anonymous or not, it asks the server for the current directory with the PWD command. The server then responds with a 257 response containing the path, inside double...

Security fix for the ALT Linux 8 package curl version 7.56.0-alt1

Oct. 4, 2017 Anton Farygin 7.56.0-alt1 - new version - fixes: CVE-2017-1000254 libcurl may read outside of a heap allocated buffer when doing FTP...

cURL -- out of bounds read

The cURL project reports: FTP PWD response parser out of bounds read libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in anonymous or not, it asks the server for the current directory with the PWD command. The server...

CVE-2017-1000254

libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in anonymous or not, it asks the server for the current directory with the PWD command. The server then responds with a 257 response containing the path, inside double...

[SECURITY] Fedora 27 Update: pure-ftpd-1.0.46-2.fc27

Pure-FTPd is a fast, production-quality, standard-comformant FTP server, based upon Troll-FTPd. Unlike other popular FTP servers, it has no known security flaw, it is really trivial to set up and it is especially designed for modern Linux and FreeBSD kernels setfsuid, sendfile, capabilities...

Faleemi FSC-880 CSRF / SQL Injection / Command Execution

Full disclosure is here: https://medium.com/iotsploit/faleemi-fsc-880-multiple-security-vulnerabilities-ed1d132c2cce === Timeline: 25 August 2017: the research was made 29 August 2017: an email was sent to the vendor, but with no answer 25 September 2017: public disclosure 26 September 2017:...

[SECURITY] Fedora 26 Update: pure-ftpd-1.0.46-2.fc26

Pure-FTPd is a fast, production-quality, standard-comformant FTP server, based upon Troll-FTPd. Unlike other popular FTP servers, it has no known security flaw, it is really trivial to set up and it is especially designed for modern Linux and FreeBSD kernels setfsuid, sendfile, capabilities...

[slackware-security] python

New python packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/python-2.7.14-i586-1slack14.2.txz: Upgraded. Updated to the latest 2.7.x release. This fixes some security issues relate...

[slackware-security] libxml2

New libxml2 packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/libxml2-2.9.5-i586-1slack14.2.txz: Upgraded. This release fixes some security issues: Detect infinite recursion in...

EternalBlue Exploit Used in Retefe Banking Trojan Campaign

Criminals behind the Retefe banking Trojan have added a new component to their malware that uses the NSA exploit EternalBlue. The update makes Retefe the latest malware family to adopt the SMBv1 attack against a patched Windows vulnerability, and could signal an emerging trend, said researchers a...