Moderate: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Amazon Linux AMI : curl (ALAS-2017-922)

IMAP FETCH response out of bounds read : A buffer overrun flaw was found in the IMAP handler of libcurl. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the application...

Medium: curl

Issue Overview: IMAP FETCH response out of bounds read: A buffer overrun flaw was found in the IMAP handler of libcurl. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the...

Amazon Linux AMI : curl (ALAS-2017-919)

FTP PWD response parser out of bounds read libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in anonymous or not, it asks the server for the current directory with the PWD command. The server then responds with a 257...

Medium: curl

Issue Overview: FTP PWD response parser out of bounds read libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in anonymous or not, it asks the server for the current directory with the PWD command. The server then...

[ASA-201711-10] libcurl-compat: information disclosure

Arch Linux Security Advisory ASA-201711-10 ========================================== Severity: Medium Date : 2017-11-02 CVE-ID : CVE-2017-1000257 Package : libcurl-compat Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-463 Summary ======= The package...

[ASA-201711-8] lib32-libcurl-compat: information disclosure

Arch Linux Security Advisory ASA-201711-8 ========================================= Severity: Medium Date : 2017-11-02 CVE-ID : CVE-2017-1000257 Package : lib32-libcurl-compat Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-465 Summary ======= The package...

[ASA-201711-9] lib32-libcurl-gnutls: information disclosure

Arch Linux Security Advisory ASA-201711-9 ========================================= Severity: Medium Date : 2017-11-02 CVE-ID : CVE-2017-1000257 Package : lib32-libcurl-gnutls Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-464 Summary ======= The package...

[ASA-201711-11] libcurl-gnutls: information disclosure

Arch Linux Security Advisory ASA-201711-11 ========================================== Severity: Medium Date : 2017-11-02 CVE-ID : CVE-2017-1000257 Package : libcurl-gnutls Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-462 Summary ======= The package...

Heap overflow

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that non-existing data with a pointer and the size zero to the deliver-data function. libcurl's deliver-data function treats zero as a mag...

CVE-2017-1000257

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that non-existing data with a pointer and the size zero to the deliver-data function. libcurl's deliver-data function treats zero as a mag...

ALPINE-CVE-2017-1000257

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that non-existing data with a pointer and the size zero to the deliver-data function. libcurl's deliver-data function treats zero as a mag...

CVE-2017-1000257

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that non-existing data with a pointer and the size zero to the deliver-data function. libcurl's deliver-data function treats zero as a mag...

CVE-2017-1000257

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that non-existing data with a pointer and the size zero to the deliver-data function. libcurl's deliver-data function treats zero as a mag...

CVE-2017-1000257

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that non-existing data with a pointer and the size zero to the deliver-data function. libcurl's deliver-data function treats zero as a mag...

CVE-2017-1000257

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that non-existing data with a pointer and the size zero to the deliver-data function. libcurl's deliver-data function treats zero as a mag...

CVE-2017-1000257

CVE-2017-1000257: A heap-based buffer overrun in libcurl’s IMAP FETCH handling (zero-length data) can cause reading past the end of a heap buffer, potentially disclosing information or crashing the application. Upstream fix and downstream advisories implement version bumps to 7.56.1-1 or later; a...

CVE-2017-1000257

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that non-existing data with a pointer and the size zero to the deliver-data function. libcurl's deliver-data function treats zero as a mag...

CURL-CVE-2017-1000257 IMAP FETCH response out of bounds read

libcurl contains a buffer overrun flaw in the IMAP handler. An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that non-existing data with a pointer and the size zero to the deliver-data...

CVE-2017-1000257

A buffer overrun flaw was found in the IMAP handler of libcurl. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the application. Mitigation Switch off IMAP in CURLOPTPROTOCOLS...