CVE-2019-5435

CVE-2019-5435 affects curl/libcurl: an integer overflow in curl_url_set() within the URL API can cause a heap/buffer overflow in libcurl versions from 7.62.0 up to 7.64.1. The issue exists on affected builds and can lead to memory corruption; 32‑bit considerations are described in related advisor...

CVE-2019-5435

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1...

CVE-2019-5435

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1...

Heap-based Buffer Overflow

libcurl.so is vulnerable to heap-based buffer overflow. The function tftpreceivepacket that receives data from a TFTP server calls recvfrom with the default size instead of the size that was allocated, potentially resulting in an overwrite of the heap memory...

Haxx libcurl Buffer Overflow Vulnerability

Haxx libcurl is an open source client-side URL transport library from the Swedish company Haxx. It supports protocols such as FTP, SFTP, TFTP and HTTP. A buffer overflow vulnerability exists in the TFTP receive code in Haxx libcurl versions 7.19.4 through 7.64.1, which can be exploited by an...

Haxx libcurl Integer Overflow Vulnerability

Haxx libcurl is an open source client-side URL transport library from the Swedish company Haxx. It supports protocols such as FTP, SFTP, TFTP and HTTP. An integer overflow vulnerability exists in Haxx libcurl versions 7.62.0 through 7.64.1, which can be exploited by an attacker to cause a buffer...

CVE-2019-5436

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1...

CVE-2019-5435

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1...

CURL-CVE-2019-5436 TFTP receive buffer overflow

libcurl contains a heap buffer overflow in the function tftpreceivepacket that receives data from a TFTP server. It calls recvfrom with the default size for the buffer rather than with the size that was used to allocate it. Thus, the content that might overwrite the heap memory is entirely...

UBUNTU-CVE-2019-5436

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1...

CVE-2019-5435

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1...

CVE-2019-5436

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1...

Out-Of-Bounds Read

libcurl is vulnerable to out-of-bounds read attacks. A remote server could return a specially crafted response to a PWD command issued by the target connected client library to trigger a parsing error and cause libcurl to crash...

Denial Of Service (DoS)

libcurl.so is vulnerable to buffer over-read. There is a flaw in the application when reading RTSP responses, if there are no headers in the RTSP responses the library reads beyond the buffer, leading to the reading of sensitive information beyond the buffer or to the application crashing...

Session Hijacking

curl and libcurl are vulnerable to session hijacking. A remote user may be able to access data sent via a re-used TLS connection with the wrong or missing client certificate. The affected component is TLS Connection Handler...

CRLF Injection

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. It was found that the libcurl library did not correctly handle partial literal IP addresses when parsing received HTTP cookies. An attacker...

The vulnerability of the libcurl library, caused by buffer overflows in the stack, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Curlauthcreatentlmtype3message function, which creates the NTLM type-3 header lib/vauth/ntlm.c, from the libcurl library, is due to a buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the smtp_endofresp function in the libcurl library allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the smtpendofresp function in the libcurl library relates to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

curl: An integer overflow found in /lib/urlapi.c

Summary: libcurl contains a heap-based buffer overrun in /lib/urlapi.c. A similiar issue to CVE-2018-14618. Steps To Reproduce: analysis I found a potential integer overflow which may lead to a buffer overrun in /curl/lib/urlapi.c. In function seturl, urllen was multiplied by 2 and then passed to...

0D1N v2.6 - Web Security Tool To Make Fuzzing At HTTP/S

0d1n is a tool for automating customized attacks against web applications. You can do: Brute force login and passwords in auth forms Directory disclosure use PATH list to brute, and find HTTP status code Test to find SQL Injection and XSS vulnerabilities Options to load ANTI-CSRF token each reque...