CBL Mariner 2.0 Security Update: lldpd (CVE-2023-41910)

The version of lldpd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-41910 advisory. - An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDPTLVADDRESSES...

SUSE SLED15: curl / libcurl-devel / libcurl-devel-32bit / libcurl4 / etc (SUSE-SU-2023:3823-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3823-1 advisory. - CVE-2023-38039: Fixed possible DoS when receiving too large HTTP header. bsc1215026 Tenable has extract...

Debian DSA-5505-1 : lldpd - security update

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5505 advisory. Matteo Memelli reported an out-of-bounds read flaw when parsing CDP addresses in lldpd, an implementation of the IEEE 802.1ab LLDP protocol. A remote attacker can tak...

Debian dla-3578 : liblldpctl-dev - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3578 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3578-1 [email protected] https://www.debian.org/lts/security/...

OESA-2023-1679 opensc security update

OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures. OpenSC implements the standard APIs to sma...

RoyalTSX 6.0.1 RTSZ File Handling Heap Memory Corruption PoC

Summary Royal TS is an ideal tool for system engineers and other IT professionals who need remote access to systems with different protocols. Not only easy to use, it enables secure multi-user document sharing. Description The application receives SIGABRT after RAPortCheck.createNWConnection...

SUSE SLES12 Security Update : curl (SUSE-SU-2023:3692-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3692-1 advisory. - CVE-2023-38039: Fixed possible DoS when receiving too large HTTP header. bsc1215026 Tenable has extracted the preceding description block...

FreeBSD : curl -- HTTP headers eat all memory (833b469b-5247-11ee-9667-080027f5fec9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 833b469b-5247-11ee-9667-080027f5fec9 advisory. - When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed lat...

CVE-2023-38039

A flaw was found in the Curl package. Curl allows a malicious server to stream an endless series of headers to a client due to missing limit on header quantity, eventually causing curl to run out of heap memory, which may lead to a crash...

AZL-38341 CVE-2023-38039 affecting package tensorflow for versions less than 2.16.1-1

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of header...

AZL-29698 CVE-2023-38039 affecting package curl for versions less than 8.3.0-1

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of header...

DEBIAN-CVE-2023-38039

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of header...

ALPINE-CVE-2023-38039

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of header...

CVE-2023-38039

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of header...

CVE-2023-38039

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of header...

curl security vulnerability

Curl is a tool used to transfer data from or to a server. A security vulnerability exists in curl that stems from not limiting the number or size of http headers, allowing a malicious server to ultimately cause curl to exhaust heap memory by transmitting sequence headers...

SUSE CVE-2023-38039

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of header...

HTTP headers eat all memory

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit on the size or quantity of headers it would accept in a response, allowing a malicious server to stream an endless series of...

CVE-2023-38039

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of header...

An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c.

...