Low: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 7.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

curl: Invalid write (or double free) triggers curl command line tool crash

Summary: Whilst fuzzing libcurl built from git commit a158a09, a crash triggered by an invalid write or maybe a double/invalid free was found. Steps To Reproduce: Run: echo "LVQvCnVyIDA=" | base64 -d test0000 ./curl --verbose -q -K test0000 file:///dev/null Stack: valgrind -q src/curl --verbose -...

curl: Curl_auth_create_plain_message integer overflow leads to heap buffer overflow

Summary: There is an incorrect integer overflow check in Curlauthcreateplainmessage in lib/vauth/cleartext.c , leading to a potential heap buffer overflow of controlled length and data. The exploitation seems quite easy, yet the vulnerability can only be triggered locally and does not seem to lea...

Denial Of Service (DoS)

curl and libcurl is vulnerable to denial of service DoS. The platforms allow attackers to cause a denial of service out-of-bounds access and application crash or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library...

Security Bulletin: Vulnerabilities in libcurl and cURL affect Rational DOORS (CVE-2015-3143, CVE-2015-3144, CVE-2015-3145, CVE-2015-3148, CVE-2015-3153, CVE-2015-3236)

Summary Vulnerabilities in libcurl and cURL affect Rational DOORS. Vulnerability Details CVEID: CVE-2015-3143 DESCRIPTION: libcurl could allow a remote attacker from within the local network to bypass security restrictions, caused by the re-use of recently authenticated connections. By sending a...

Security Bulletin: Security vulnerabilities in Rational DOORS (CVE-2014-3613, CVE-2014-3620, CVE-2014-8730, CVE-2014-9495, CVE-2015-0973)

Summary IBM Rational DOORS contains multiple security vulnerabilities. Vulnerability Details Rational DOORS is affected by the following vulnerabilities disclosed in and corrected by Rational DOORS fix pack releases: CVE ID: CVE-2014-3613 Description: cURL/libcURL could allow a remote attacker to...

Security Bulletin: Vulnerabilities in libcurl and cURL affect Rational DOORS

Summary Vulnerabilities in libcurl and cURL affect Rational DOORS. Vulnerability Details CVEID: CVE-2016-8616 DESCRIPTION: cURL/libcurl could allow a remote attacker to bypass security restrictions, caused by the use of case insensitive comparisons. By using valid credentials exists for a protoco...

Moderate: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

RHEL 8 : curl (RHSA-2020:1792)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1792 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTT...

Scientific Linux Security Update : curl on SL7.x x86_64 (20200407)

curl: TFTP receive heap buffer overflow in tftpreceivepacket function C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135804; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate", value:"2024/03/15";...

Security Bulletin: IBM MQ is affected by a vulnerability within cURL libcurl (CVE-2019-15601)

Summary An issue was identified within the libcurl library supplied by IBM MQ which is used for CCDT URL functionality. Vulnerability Details CVEID: CVE-2019-15601 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security restrictions, caused by improper input validation. By...

Denial Of Service (DoS)

cURL is vulnerable to denial of service DoS. When deflate compression was used, libcurl could call the registered write callback function with data exceeding the documented limit. A malicious server could use this flaw to crash an application using libcurl or, potentially, execute arbitrary code...

Arbitrary Code Execution

curl is vulnerable to arbitrary code execution. A flaw in libcurl where it would not differentiate between different target URLs when handling automatic redirects. This caused libcurl to follow any new URL that it understood, including the "file://" URL type. This could allow a remote server to...

CentOS 7 : curl (RHSA-2020:1020)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1020 advisory. - A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. CVE-2019-5436 Note tha...

curl, libcurl security update

CentOS Errata and Security Advisory CESA-2020:1020 An update for curl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

curl: TFTP receive heap buffer overflow in tftp_receive_packet() function

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1...

Low: Red Hat Security Advisory: curl security and bug fix update

An update for curl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

EulerOS Virtualization 3.0.2.2 : curl-openssl (EulerOS-SA-2020-1278)

According to the versions of the curl-openssl package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2020-1271)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 6 : curl (ELSA-2020-5561)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5561 advisory. 7.19.7-54.0.2 - Fix TFTP small blocksize heap buffer overflow https://curl.haxx.se/docs/CVE-2019-5482.htmlCVE-2019-5482Orabug:30568724 462 Tenable has extracted...