cURL/libcURL incomplete fix for remote security bypass vulnerability

Haxx curl and libcurl are both products of the Swedish company Haxx. curl is a set of file transfer tools that utilize URL syntax to work at the command line. libcurl is a free, open source client-side URL transfer library. A remote security bypass vulnerability exists in Haxx curl and libcurl. A...

curl: negotiate not treated as connection-oriented (incomplete fix for CVE-2015-3148)

It was found that the fix for CVE-2015-3148 in curl was incomplete. An application using libcurl with HTTP Negotiate authentication could incorrectly re-use credentials for subsequent requests to the same server...

Amazon Linux AMI : curl (ALAS-2017-806)

libcurl's implementation of the printf functions triggers a buffer overflow when doing a large floating point output. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks. This flaw does not exist in the comman...

Low: curl

Issue Overview: libcurl's implementation of the printf functions triggers a buffer overflow when doing a large floating point output. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks. This flaw does not exi...

Tenable SecurityCenter 5.x < 5.4.3 Multiple Vulnerabilities (TNS-2017-04) (httpoxy)

According to its version, the installation of Tenable SecurityCenter on the remote host is affected by multiple vulnerabilities : - A flaw exists in the modsessioncrypto module due to encryption for data and cookies using the configured ciphers with possibly either CBC or ECB modes of operation...

cURL/libcURL 7.x < 7.33.0 Host Name Validation Bypass

Binary data 9979.prm...

[ASA-201701-10] lib32-libcurl-compat: multiple issues

Arch Linux Security Advisory ASA-201701-10 ========================================== Severity: Medium Date : 2017-01-03 CVE-ID : CVE-2016-9586 CVE-2016-9594 Package : lib32-libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-116 Summary ======= The packag...

[ASA-201701-8] libcurl-gnutls: multiple issues

Arch Linux Security Advisory ASA-201701-8 ========================================= Severity: Medium Date : 2017-01-03 CVE-ID : CVE-2016-9586 CVE-2016-9594 Package : libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-114 Summary ======= The package...

[ASA-201701-11] lib32-libcurl-gnutls: multiple issues

Arch Linux Security Advisory ASA-201701-11 ========================================== Severity: Medium Date : 2017-01-03 CVE-ID : CVE-2016-9586 CVE-2016-9594 Package : lib32-libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-117 Summary ======= The packag...

[ASA-201701-7] libcurl-compat: multiple issues

Arch Linux Security Advisory ASA-201701-7 ========================================= Severity: Medium Date : 2017-01-03 CVE-ID : CVE-2016-9586 CVE-2016-9594 Package : libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-113 Summary ======= The package...

DLA-767-1 curl - security update

Bulletin has no description...

Haxx curl and libcurl security bypass vulnerability

Haxx curl and libcurl are both products of the Swedish company Haxx. curl is a set of file transfer tools that utilize URL syntax to work at the command line. libcurl is a free, open source client-side URL transfer library. A remote security bypass vulnerability exists in Haxx libcurl version...

FreeBSD : cURL -- uninitialized random vulnerability (c40ca16c-4d9f-4d70-8b6c-4d53aeb8ead4)

Project curl Security Advisory : libcurl's new internal function that returns a good 32bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to. This random value is used to generate nonces for Digest and NTLM...

[ASA-201612-22] curl: multiple issues

Arch Linux Security Advisory ASA-201612-22 ========================================== Severity: Medium Date : 2016-12-27 CVE-ID : CVE-2016-9586 CVE-2016-9594 Package : curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-112 Summary ======= The package curl before...

CURL-CVE-2016-9594 uninitialized random

libcurl's new internal function that returns a good 32-bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to. This random value is used to generate nonces for Digest and NTLM authentication, for generating boundary...

cURL -- uninitialized random vulnerability

Project curl Security Advisory: libcurl's new internal function that returns a good 32bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to. This random value is used to generate nonces for Digest and NTLM...

cURL/libcURL Buffer Overflow Vulnerability

Haxx curl and libcurl are both products of the Swedish company Haxx. curl is a set of file transfer tools that utilize URL syntax to work at the command line. libcurl is a free, open source client-side URL transfer library. A buffer overflow vulnerability exists in Haxx curl and libcurl versions...

CVE-2016-9586

curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks...

CURL-CVE-2016-9586 printf floating point buffer overflow

libcurl's implementation of the printf functions triggers a buffer overflow when doing a large floating point output. The bug occurs when the conversion outputs more than 255 bytes. The flaw happens because the floating point conversion is using system functions without the correct boundary check...

printf floating point buffer overflow

libcurl's implementation of the printf functions triggers a buffer overflow when doing a large floating point output. The bug occurs when the conversion outputs more than 255 bytes. The flaw happens because the floating point conversion is using system functions without the correct boundary check...