887 matches found
Code injection
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host...
CVE-2016-8625
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host...
UBUNTU-CVE-2016-8625
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host...
CVE-2016-8625
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host...
CVE-2016-8625
CVE-2016-8625 affects curl/libcurl prior to 7.51.0 when built with libidn, using IDNA 2003 instead of IDNA 2008. This mismatch can cause requests to the wrong host. Impact described in connected docs includes remote code execution, cookie injection, and information disclosure via multiple vectors...
Security Bulletin: Vulnerabilities in cURL component shipped with IBM Rational ClearCase (CVE-2016-8624, CVE-2016-8625)
Summary IBM Rational ClearCase is affected by cURL/libcURL access restriction bypass and network host spoofing vulnerabilities. Vulnerability Details CVEID: CVE-2016-8624 DESCRIPTION: cURL/libcurl could allow a remote attacker to bypass security restrictions, caused by the failure to parse the...
[SECURITY] Fedora 27 Update: libidn-1.34-1.fc27
GNU Libidn is an implementation of the Stringprep, Punycode and IDNA specifications defined by the IETF Internationalized Domain Names IDN working group, used for internationalized domain names...
[SECURITY] Fedora 28 Update: libidn-1.34-1.fc28
GNU Libidn is an implementation of the Stringprep, Punycode and IDNA specifications defined by the IETF Internationalized Domain Names IDN working group, used for internationalized domain names...
Libidn2 'decode_digit' function integer overflow vulnerability
Libidn2 is a package that implements string preprocessing, Punycode, and IDNA specification definitions through the IETF International Domain Name IDN. An integer overflow vulnerability exists in the 'decodedigit' function of the punydecode.c file in Libidn2 versions prior to 2.0.4. A remote...
cURL/libcurl 7.x < 7.51.0 Multiple Vulnerabilities
Binary data 9826.prm...
CURL-CVE-2016-8625 IDNA 2003 makes curl use wrong host
When curl is built with libidn to handle International Domain Names IDNA, it translates them to puny code for DNS resolving using the IDNA 2003 standard, while IDNA 2008 is the modern and up-to-date IDNA standard. This misalignment causes problems with for example domains using the German ß...
Security fix for the ALT Linux 8 package curl version 7.51.0-alt1
Nov. 2, 2016 Anton Farygin 7.51.0-alt1 - new version with security fixes: CVE-2016-8615: cookie injection for other servers CVE-2016-8616: case insensitive password comparison CVE-2016-8617: OOB write via unchecked multiplication CVE-2016-8618: double-free in curlmaprintf CVE-2016-8619: double-fr...
[SECURITY] Fedora 25 Update: mingw-libidn-1.33-1.fc25
GNU Libidn is an implementation of the Stringprep, Punycode and IDNA specifications defined by the IETF Internationalized Domain Names IDN working group, used for internationalized domain names...
TYPO3 'mso/idna-convert' Library Cross-Site Scripting Vulnerability
TYPO3 is a free and open source content management system maintained by the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in TYPO3 'mso/idna-convert'. Because the program fails to filter user-supplied input, an attacker could exploit the vulnerability to execute arbitrary...
[SECURITY] Fedora 23 Update: libidn-1.33-1.fc23
GNU Libidn is an implementation of the Stringprep, Punycode and IDNA specifications defined by the IETF Internationalized Domain Names IDN working group, used for internationalized domain names...
GNU Libidn Remote Arbitrary Code Execution Vulnerability
GNU Libidn is a package that implements string preprocessing, Punycode, and IDNA specification definitions via the IETF International Domain Name IDN. A remote arbitrary code execution vulnerability exists in GNU Libidn. An attacker could exploit this vulnerability to execute arbitrary code in th...
TYPO3 'mso/idna-convert' Library Cross Site Scripting Vulnerability (Jul 2016)
TYPO3 is prone to a cross site scripting vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3"; ifdescripti...
[SECURITY] Fedora 24 Update: libidn-1.33-1.fc24
GNU Libidn is an implementation of the Stringprep, Punycode and IDNA specifications defined by the IETF Internationalized Domain Names IDN working group, used for internationalized domain names...
