curl -- TFTP packet buffer overflow vulnerability

A Project cURL Security Advisory reports: libcurl uses the given file part of a TFTP URL in a manner that allows a malicious user to overflow a heap-based memory buffer due to the lack of boundary check. This overflow happens if you pass in a URL with a TFTP protocol prefix "tftp://", using a val...

[SECURITY] [DSA 919-2] New curl packages fix potential security problem

-------------------------------------------------------------------------- Debian Security Advisory DSA 919-2 [email protected] http://www.debian.org/security/ Martin Schulze Marth 10th, 2006 http://www.debian.org/security/faq -...

Mandrake Linux Security Advisory : wget (MDKSA-2005:183)

A vulnerability in libcurl's NTLM function can overflow a stack-based buffer if given too long a user name or domain name in NTLM authentication is enabled and either a pass a user and domain name to libcurl that together are longer than 192 bytes or b allow libcurl to follow HTTP redirects and t...

Mandrake Linux Security Advisory : curl (MDKSA-2005:224)

Stefan Esser discovered that libcurl's URL parser function can have a malloced buffer overflows in two ways if given a too long URL. It cannot be triggered by a redirect, which makes remote exploitation unlikely, but can be passed directly to libcurl allowing for local exploitation and could also...

security flaw

Multiple off-by-one errors in the cURL library libcurl 7.11.2 through 7.15.0 allow local users to trigger a buffer overflow and cause a denial of service or bypass PHP security restrictions via certain URLs that 1 are malformed in a way that prevents a terminating null byte from being added to...

GLSA-200512-09 : cURL: Off-by-one errors in URL handling

The remote host is affected by the vulnerability described in GLSA-200512-09 cURL: Off-by-one errors in URL handling Stefan Esser from the Hardened-PHP Project has reported a vulnerability in cURL that allows for a local buffer overflow when cURL attempts to parse specially crafted URLs. The URL...

[SECURITY] [DSA 919-1] New curl packages fix potential security problem

-------------------------------------------------------------------------- Debian Security Advisory DSA 919-1 [email protected] http://www.debian.org/security/ Martin Schulze December 12th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 919-1] New curl packages fix potential security problem

-------------------------------------------------------------------------- Debian Security Advisory DSA 919-1 [email protected] http://www.debian.org/security/ Martin Schulze December 12th, 2005 http://www.debian.org/security/faq -...

DEBIAN-CVE-2005-4077

Multiple off-by-one errors in the cURL library libcurl 7.11.2 through 7.15.0 allow local users to trigger a buffer overflow and cause a denial of service or bypass PHP security restrictions via certain URLs that 1 are malformed in a way that prevents a terminating null byte from being added to...

Advisory 24/2005: libcurl URL parsing vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: libcurl URL Parsing Vulnerability Release Date: 2005/12/07 Last Modified: 2005/12/07 Author: Stefan Esser [email protected] Application: Curl = 7.15.0 libcurl = 7.15.0...

URL Buffer Overflow

libcurl's URL parser function can overflow a heap based buffer in two ways, if given a too long URL. These overflows happen if you 1 - pass in a URL with no protocol like "http://" prefix, using no slash and the string is 256 bytes or longer. This leads to a single zero byte overflow of the heap...

CURL-CVE-2005-4077 URL Buffer Overflow

libcurl's URL parser function can overflow a heap based buffer in two ways, if given a too long URL. These overflows happen if you 1 - pass in a URL with no protocol like "http://" prefix, using no slash and the string is 256 bytes or longer. This leads to a single zero byte overflow of the heap...

curl -- URL buffer overflow vulnerability

A Project cURL Security Advisory reports: libcurl's URL parser function can overflow a malloced buffer in two ways, if given a too long URL. 1 - pass in a URL with no protocol like "http://" prefix, using no slash and the string is 256 bytes or longer. This leads to a single zero byte overflow of...

security flaw

Stack-based buffer overflow in the ntlmoutput function in http-ntlm.c for 1 wget 1.10, 2 curl 7.13.2, and 3 libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username...

Mandrake Linux Security Advisory : curl (MDKSA-2005:182)

A vulnerability in libcurl's NTLM function can overflow a stack-based buffer if given too long a user name or domain name in NTLM authentication is enabled and either a pass a user and domain name to libcurl that together are longer than 192 bytes or b allow libcurl to follow HTTP redirects and t...

DEBIAN-CVE-2005-3185

Stack-based buffer overflow in the ntlmoutput function in http-ntlm.c for 1 wget 1.10, 2 curl 7.13.2, and 3 libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username...

CVE-2005-3185

Stack-based buffer overflow in the ntlmoutput function in http-ntlm.c for 1 wget 1.10, 2 curl 7.13.2, and 3 libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username...

CVE-2005-3185

Stack-based buffer overflow in the ntlmoutput function in http-ntlm.c for 1 wget 1.10, 2 curl 7.13.2, and 3 libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username...

CVE-2005-3185

Stack-based buffer overflow in the ntlmoutput function in http-ntlm.c for 1 wget 1.10, 2 curl 7.13.2, and 3 libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username...

NTLM Buffer Overflow

libcurl's NTLM function can overflow a stack-based buffer if given a too long username or domain name. This would happen if you enable NTLM authentication and either: A - pass in a username and domain name to libcurl that together are longer than 192 bytes B - allow libcurl to follow HTTP...