libcurl information leakage

Cookie can be leaked to wrong site...

cURL/libcURL Cookie handling remote security bypass Vulnerability(CVE-2 0 1 4-3 6 2 0)-vulnerability warning-the black bar safety net

Affected system: cURL cURL 7.31.0 - 7.37.1 Description: BUGTRAQ ID: 6 9 7 4 2 CVECAN ID: CVE-2 0 1 4-3 6 2 0 cURL/libcURL is a command-line file transfer tool that supports FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE and LDAP. cURL/libcURL 7.31.0 - 7.37.1 version error for TLD set a cookie...

cURL/libcURL 7.x < 7.38.0 Multiple Vulnerabilities

Binary data 8385.prm...

CURL-CVE-2014-3620 cookie leak for TLDs

libcurl wrongly allows cookies to be set for Top Level Domains TLDs, thus making them apply broader than cookies are allowed. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain...

cookie leak with IP address as domain

By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP cookies, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others. For this problem to trigger, the client application...

cookie leak for TLDs

libcurl wrongly allows cookies to be set for Top Level Domains TLDs, thus making them apply broader than cookies are allowed. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain...

CURL-CVE-2014-3613 cookie leak with IP address as domain

By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP cookies, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others. For this problem to trigger, the client application...

CVE-2014-3613

cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1...

UBUNTU-CVE-2014-3620

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain...

UBUNTU-CVE-2014-3613

cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1...

CVE-2014-3620

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain...

Debian: Security Advisory (DSA-3022-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

cURL Buffer Overflow Vulnerability

No description provided by source. cURL buffer overflow Wed 06 February 2013 Volema found remotely exploitable buffer overflow vulnerability in libcurl POP3, SMTP protocol handlers which lead to code execution RCE. When negotiating SASL DIGEST-MD5 authentication, the function...

openSUSE Security Update : curl (openSUSE-SU-2013:0876-1)

libcurl was updated to fix a cookie tail matching flaw which could lead to attackers gaining cookie access depending on domain names. CVE-2013-1944,bnc814655 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

openSUSE Security Update : curl (openSUSE-SU-2014:0598-1)

This curl update fixes two security issues : - bnc868627: Fixed wrong re-use of connections CVE-2014-0138. - bnc868629: Fixed IP address wildcard certificate validation CVE-2014-0139. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openSUSE Security Update : curl / libcurl (openSUSE-SU-2013:1132-1)

A vulnerability was discovered for the curl and libcurl packages in openSUSE versions 12.2 and 12.3. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2013-552. The text description of...

openSUSE Security Update : curl (openSUSE-SU-2013:1859-1)

This update fixes the following security issues with curl : - fix CVE-2013-4545 bnc849596 = acknowledge VERIFYHOST without VERIFYPEER %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

PT-2016-5688 · Openssl +3 · Polarssl +4

Name of the Vulnerable Software and Affected Versions: cURL and libcurl versions prior to 7.49.0 Description: The issue allows remote attackers to spoof servers via an arbitrary valid certificate when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address. This occurs...

CentOS Update for curl CESA-2014:0561 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS 6 : curl (CESA-2014:0561)

Updated curl packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...