CVE-2007-3564

libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SSL/TLS certificate expiration or activation dates, which allows remote attackers to bypass certain access restrictions...

DSA-1333-1 curl

Bulletin has no description...

Security fix for the ALT Linux 8 package clamav version 0.91-alt1

July 13, 2007 Victor Forsyuk 0.91-alt1 - Fixes security bug: https://wwws.clamav.net/bugzilla/showbug.cgi?id=555 CVE-2007-3725. - Use of libcurl removed should improve stability...

Security fix for the ALT Linux 10 package clamav version 0.91-alt1

July 13, 2007 Victor Forsyuk 0.91-alt1 - Fixes security bug: https://wwws.clamav.net/bugzilla/showbug.cgi?id=555 CVE-2007-3725. - Use of libcurl removed should improve stability...

CURL-CVE-2007-3564 GnuTLS insufficient cert verification

libcurl when built to use GnuTLS fails to verify that a peer's certificate has not already expired or has not yet become valid. This allows malicious servers to present certificates to libcurl that were not rejected properly. Notably, the CA certificate and common name checks are still in place...

SOL4447 - cURL buffer overflow vulnerability - CAN-2005-0490

Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by 1 the Curlinputntlm functio...

cURL Safe Mode Bypass PHP 4.4.2 and 5.1.4

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 cURL Safe Mode Bypass PHP 4.4.2 and 5.1.4 Author: Maksymilian Arciemowicz cXIb8O3 Date: - -Written: 15.5.2006 - -Public: 27.5.2006 from SECURITYREASON.COM CVE-2006-2563 - --- 0.Description --- PHP is an HTML-embedded scripting language. Much of its...

FreeBSD : curl -- TFTP packet buffer overflow vulnerability (b8e361b8-b7ff-11da-8414-0013d4a4a40e)

A Project cURL Security Advisory reports : libcurl uses the given file part of a TFTP URL in a manner that allows a malicious user to overflow a heap-based memory buffer due to the lack of boundary check. This overflow happens if you pass in a URL with a TFTP protocol prefix 'tftp://', using a...

[SA20077] Mac OS X Security Update Fixes Multiple Vulnerabilities

TITLE: Mac OS X Security Update Fixes Multiple Vulnerabilities SECUNIA ADVISORY ID: SA20077 VERIFY ADVISORY: http://secunia.com/advisories/20077/ CRITICAL: Highly critical IMPACT: Security Bypass, Exposure of sensitive information, DoS, System access WHERE: From remote OPERATING SYSTEM: Apple...

GLSA-200603-25 : OpenOffice.org: Heap overflow in included libcurl

The remote host is affected by the vulnerability described in GLSA-200603-25 OpenOffice.org: Heap overflow in included libcurl OpenOffice.org includes libcurl code. This libcurl code is vulnerable to a heap overflow when it tries to parse a URL that exceeds a 256-byte limit GLSA 200512-09. Impact...

[ GLSA 200603-25 ] OpenOffice.org: Heap overflow in included libcurl

Gentoo Linux Security Advisory GLSA 200603-25 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

OpenOffice.org: Heap overflow in included libcurl

Background OpenOffice.org is an office productivity suite, including word processing, spreadsheet, presentation, data charting, formula editing and file conversion facilities. libcurl, which is included in OpenOffice.org, is a free and easy-to-use client-side library for transferring files with U...

GLSA-200603-19 : cURL/libcurl: Buffer overflow in the handling of TFTP URLs

The remote host is affected by the vulnerability described in GLSA-200603-19 cURL/libcurl: Buffer overflow in the handling of TFTP URLs Ulf Harnhammar reported a possible buffer overflow in the handling of TFTP URLs in libcurl due to the lack of boundary checks. Impact : An attacker could exploit...

Heap overflow

Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL tftp:// with a valid hostname and a long path...

CVE-2006-1061

Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL tftp:// with a valid hostname and a long path...

CVE-2006-1061

Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL tftp:// with a valid hostname and a long path...

CVE-2006-1061

Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL tftp:// with a valid hostname and a long path...

CVE-2006-1061

CVE-2006-1061 is a heap-based buffer overflow in curl/libcurl (versions 7.15.0–7.15.2) triggered by very long TFTP URLs. A remote attacker could exploit this via a tftp:// URL with a valid hostname and long path to execute arbitrary commands. Public docs reference vendor advisories (Gentoo GLSA, ...

cURL/libcurl: Buffer overflow in the handling of TFTP URLs

Background cURL is a command line tool for transferring files with URL syntax, supporting numerous protocols. libcurl is the corresponding client-side library. Description Ulf Harnhammar reported a possible buffer overflow in the handling of TFTP URLs in libcurl due to the lack of boundary checks...

TFTP Packet Buffer Overflow

libcurl uses the given file part of a TFTP URL in a manner that allows a malicious user to overflow a heap-based memory buffer due to the lack of boundary check. This overflow happens if you pass in a URL with a TFTP protocol prefix "tftp://", using a valid host and a path part that is longer tha...