CVE-2016-9952

The verifycertificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted wildcard SAN in a server certificate, as demonstrated by ".com....

CVE-2016-9953

The verifycertificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service crash, or possibly have unspecified other impact via a wildcard...

CVE-2016-9952

The verifycertificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted wildcard SAN in a server certificate, as demonstrated by ".com....

CVE-2016-9953

The verifycertificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service crash, or possibly have unspecified other impact via a wildcard...

CVE-2016-9952

The CVE-2016-9952 issue affects libcurl (lib/vtls/schannel.c) in Windows CE builds using the schannel TLS backend. It arises in verify_certificate for libcurl versions 7.30.0 through 7.51.0 and allows remote attackers to perform MITM attacks by presenting a crafted wildcard SAN in the server cert...

CVE-2016-9953

The CVE-2016-9953 entry affects libcurl 7.30.0–7.51.0 when built for Windows CE with the schannel TLS backend, where the verify_certificate function in lib/vtls/schannel.c can be abused by a crafted wildcard certificate name to trigger an out-of-bounds read. This can allow remote attackers to obt...

CVE-2016-9953

The verifycertificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service crash, or possibly have unspecified other impact via a wildcard...

CVE-2016-9952

The verifycertificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted wildcard SAN in a server certificate, as demonstrated by ".com....

CVE-2016-9952

The verifycertificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted wildcard SAN in a server certificate, as demonstrated by ".com....

CVE-2016-9953

The verifycertificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service crash, or possibly have unspecified other impact via a wildcard...

Amazon Linux AMI : curl (ALAS-2018-951)

Out-of-bounds read in code handling HTTP/2 trailers : libcurl contains an out bounds read in code handling HTTP/2 trailers. It was reported https://github.com/curl/curl/pull/2231 that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. Th...

Important: curl

Issue Overview: HTTP authentication leak in redirects libcurl might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and...

FreeBSD : cURL -- Multiple vulnerabilities (0cbf0fa6-dcb7-469c-b87a-f94cffd94583)

The cURL project reports : libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X...

[ASA-201801-26] lib32-libcurl-compat: multiple issues

Arch Linux Security Advisory ASA-201801-26 ========================================== Severity: Medium Date : 2018-01-29 CVE-ID : CVE-2018-1000005 CVE-2018-1000007 Package : lib32-libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-598 Summary ======= The...

[ASA-201801-23] libcurl-compat: multiple issues

Arch Linux Security Advisory ASA-201801-23 ========================================== Severity: Medium Date : 2018-01-29 CVE-ID : CVE-2018-1000005 CVE-2018-1000007 Package : libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-595 Summary ======= The packag...

[ASA-201801-24] libcurl-gnutls: multiple issues

Arch Linux Security Advisory ASA-201801-24 ========================================== Severity: Medium Date : 2018-01-29 CVE-ID : CVE-2018-1000005 CVE-2018-1000007 Package : libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-596 Summary ======= The packag...

[ASA-201801-25] lib32-libcurl-gnutls: multiple issues

Arch Linux Security Advisory ASA-201801-25 ========================================== Severity: Medium Date : 2018-01-29 CVE-ID : CVE-2018-1000005 CVE-2018-1000007 Package : lib32-libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-597 Summary ======= The...

[ASA-201801-20] curl: multiple issues

Arch Linux Security Advisory ASA-201801-20 ========================================== Severity: Medium Date : 2018-01-28 CVE-ID : CVE-2018-1000005 CVE-2018-1000007 Package : curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-593 Summary ======= The package curl...

Haxx libcurl out-of-bounds read vulnerability

Haxx libcurl is a free , open source client-side URL transport library from the Swedish company Haxx. The library supports FTP, FTPS, TFTP, HTTP and so on. A security vulnerability exists in code handling HTTP/2 trailers in Haxx libcurl versions 7.49.0 through 7.57.0. An attacker can exploit this...

Haxx libcurl HTTP Authentication Disclosure Vulnerability

Haxx libcurl is a free , open source client-side URL transport library from the Swedish company Haxx. The library supports FTP, FTPS, TFTP, HTTP and so on. A security vulnerability exists in Haxx libcurl versions 7.1 through 7.57.0. An attacker can exploit the vulnerability to obtain sensitive...