CVE-2019-5436: Heap-based Buffer Overflow

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1...

Heap-based Buffer Overflow

libcurl.so is vulnerable to heap-based buffer overflow. The function tftpreceivepacket that receives data from a TFTP server calls recvfrom with the default size instead of the size that was allocated, potentially resulting in an overwrite of the heap memory...

Haxx libcurl Integer Overflow Vulnerability

Haxx libcurl is an open source client-side URL transport library from the Swedish company Haxx. It supports protocols such as FTP, SFTP, TFTP and HTTP. An integer overflow vulnerability exists in Haxx libcurl versions 7.62.0 through 7.64.1, which can be exploited by an attacker to cause a buffer...

Haxx libcurl Buffer Overflow Vulnerability

Haxx libcurl is an open source client-side URL transport library from the Swedish company Haxx. It supports protocols such as FTP, SFTP, TFTP and HTTP. A buffer overflow vulnerability exists in the TFTP receive code in Haxx libcurl versions 7.19.4 through 7.64.1, which can be exploited by an...

CVE-2019-5436

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1...

CVE-2019-5435

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1...

CURL-CVE-2019-5436 TFTP receive buffer overflow

libcurl contains a heap buffer overflow in the function tftpreceivepacket that receives data from a TFTP server. It calls recvfrom with the default size for the buffer rather than with the size that was used to allocate it. Thus, the content that might overwrite the heap memory is entirely...

CVE-2019-5435

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1...

CVE-2019-5436

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1...

UBUNTU-CVE-2019-5436

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1...

PT-2019-2326

Name of the Vulnerable Software and Affected Versions libcurl versions 7.19.4 through 7.64.1 Description A heap buffer overflow in the TFTP receiving code allows for denial of service or arbitrary code execution. The issue is related to the tftp receive packet function, which can be exploited to...

Out-Of-Bounds Read

libcurl is vulnerable to out-of-bounds read attacks. A remote server could return a specially crafted response to a PWD command issued by the target connected client library to trigger a parsing error and cause libcurl to crash...

Denial Of Service (DoS)

libcurl.so is vulnerable to buffer over-read. There is a flaw in the application when reading RTSP responses, if there are no headers in the RTSP responses the library reads beyond the buffer, leading to the reading of sensitive information beyond the buffer or to the application crashing...

Session Hijacking

curl and libcurl are vulnerable to session hijacking. A remote user may be able to access data sent via a re-used TLS connection with the wrong or missing client certificate. The affected component is TLS Connection Handler...

CRLF Injection

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. It was found that the libcurl library did not correctly handle partial literal IP addresses when parsing received HTTP cookies. An attacker...

The vulnerability of the libcurl library, caused by buffer overflows in the stack, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Curlauthcreatentlmtype3message function, which creates the NTLM type-3 header lib/vauth/ntlm.c, from the libcurl library, is due to a buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the smtp_endofresp function in the libcurl library allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the smtpendofresp function in the libcurl library relates to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

curl: An integer overflow found in /lib/urlapi.c

Summary: libcurl contains a heap-based buffer overrun in /lib/urlapi.c. A similiar issue to CVE-2018-14618. Steps To Reproduce: analysis I found a potential integer overflow which may lead to a buffer overrun in /curl/lib/urlapi.c. In function seturl, urllen was multiplied by 2 and then passed to...

0D1N v2.6 - Web Security Tool To Make Fuzzing At HTTP/S

0d1n is a tool for automating customized attacks against web applications. You can do: Brute force login and passwords in auth forms Directory disclosure use PATH list to brute, and find HTTP status code Test to find SQL Injection and XSS vulnerabilities Options to load ANTI-CSRF token each reque...

Siemens SCALANCE and SIMATIC libcurl (Update B)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SCALANCE and SIMATIC Vulnerability: Out-of-bounds Read 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update titled ICSA-21-068-10 Siemens SCALANCE and...