QEMU: VNC: improper I/O watch removal in TLS handshake can lead to remote unauthenticated denial of service

A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake phase and fails, QE...

curl: heap based buffer overflow in the SOCKS5 proxy handshake

A heap-based buffer overflow flaw was found in the SOCKS5 proxy handshake in the Curl package. If Curl is unable to resolve the address itself, it passes the hostname to the SOCKS5 proxy. However, the maximum length of the hostname that can be passed is 255 bytes. If the hostname is longer, then...

ALSA-2023:5763 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: a heap-based buffer overflow in the SOCKS5 proxy handshake CVE-2023-38545 curl: cookie injection with none file...

Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: a heap-based buffer overflow in the SOCKS5 proxy handshake CVE-2023-38545 curl: cookie injection with none file...

RHEL 8 : virt:rhel (RHSA-2023:5796)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5796 advisory. Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contai...

SOCKS5 heap buffer overflow (CVE-2023-38545)

When curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255 bytes.If the hostname is detected to be longer than 255 bytes, curl switches to local name resolving and...

Important: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

OESA-2023-1736 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so,...

SUSE SLES12 Security Update : curl (SUSE-SU-2023:4043-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4043-1 advisory. - CVE-2023-38545: Fixed a heap buffer overflow in SOCKS5. bsc1215888 - CVE-2023-38546: Fixed a cookie injection with none file...

Fedora 38 : curl (2023-b855de5c0f)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-b855de5c0f advisory. - fix cookie injection with none file CVE-2023-38546 - fix SOCKS5 heap buffer overflow CVE-2023-38545 Tenable has extracted the preceding descriptio...

SUSE SLED15: curl / libcurl-devel / libcurl-devel-32bit / libcurl4 / etc (SUSE-SU-2023:4044-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4044-1 advisory. - CVE-2023-38545: Fixed a heap buffer overflow in SOCKS5. bsc1215888 - CVE-2023-38546: Fixed a...

SUSE-SU-2023:4056-1 Security update for qemu

This update for qemu fixes the following issues: - CVE-2023-3180: Fixed a buffer overflow in the virtio-crypto device bsc1213925. - CVE-2021-3750: Fixed a DMA reentrancy in the USB EHCI device that could lead to use-after-free bsc1190011. - CVE-2021-3638: Fixed a buffer overflow in the ati-vga...

[SECURITY] [DLA 3614-1] python3.7 security update

Debian LTS Advisory DLA-3614-1 [email protected] https://www.debian.org/lts/security/ Sean Whitton October 11, 2023 https://wiki.debian.org/LTS Package : python3.7 Version : 3.7.3-2+deb10u6 CVE ID : CVE-2022-48560 CVE-2022-48564 CVE-2022-48565 CVE-2022-48566 CVE-2023-40217 Several...

Heap Buffer Overflow

curl is vulnerable to Heap Buffer Overflow. The vulnerability is due to the SOCKS5 proxy handshake. If the hostname is longer then 255 bytes, curl switches to local name resolution, and passes the resolved address to the proxy. If the SOCKS5 handshake is slow, the long hostname is directly copied...

Security Bulletin: IBM Operations Analytics Predictive Insights v1.3.6 ifix7 contains fixes for multiple security vulnerabilities.

Summary IBM Operations Analytics Predictive Insights v1.3.6 ifix7 contains fixes for multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2023-32007 DESCRIPTION: Apache Spark could allow a remote authenticated attacker to execute arbitrary commands on the...

SOCKS5 heap buffer overflow

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255 bytes. If the hostname ...

CURL-CVE-2023-38545 SOCKS5 heap buffer overflow

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255 bytes. If the hostname ...

CVE-2023-38545

A heap-based buffer overflow flaw was found in the SOCKS5 proxy handshake in the Curl package. If Curl is unable to resolve the address itself, it passes the hostname to the SOCKS5 proxy. However, the maximum length of the hostname that can be passed is 255 bytes. If the hostname is longer, then...

An issue was discovered in Python before 3.8.18 3.9.x before 3.9.18 3.10.x before 3.10.13 and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created receives data into the socket buffer and then is closed quickly there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.)

...

UBUNTU-CVE-2023-38545

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host na...