UBUNTU-CVE-2019-3823

libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to smtpendofresp isn't NUL terminated and contains no character ending the parsed number, and len is set to 5, then the strtol call rea...

CVE-2018-16890

libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages lib/vauth/ntlm.c:ntlmdecodetype2target does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that...

CVE-2019-3822

libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header lib/vauth/ntlm.c:Curlauthcreatentlmtype3message, generates the request HTTP header contents based on previously received data. The check that exists ...

UBUNTU-CVE-2019-3822

libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header lib/vauth/ntlm.c:Curlauthcreatentlmtype3message, generates the request HTTP header contents based on previously received data. The check that exists ...

CVE-2019-3823

libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to smtpendofresp isn't NUL terminated and contains no character ending the parsed number, and len is set to 5, then the strtol call rea...

Security Bulletin: Vulnerability in libcurl affects IBM Chassis Management Module (CVE-2017-1000254)

Summary IBM Chassis Management Module CMM has addressed the following vulnerability in libcurl. Vulnerability Details Summary IBM Chassis Management Module CMM has addressed the following vulnerability in libcurl. Vulnerability Details CVEID: CVE-2017-1000254 Description: libcurl is vulnerable to...

Security Bulletin: Vulnerabilities in cURL/libcurl affect Intel® Manycore Platform Software Stack (Intel® MPSS) for Linux and Windows

Summary IntelR Manycore Platform Software Stack IntelR MPSS for Linux and Windows have addressed the following vulnerabilities in cURL/libcurl. Vulnerability Details Summary Intel® Manycore Platform Software Stack Intel® MPSS for Linux and Windows have addressed the following vulnerabilities in...

Security Bulletin: Vulnerability in Libcurl affects IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch firmware (CVE-2016-0755)

Summary IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch firmware has addressed the following vulnerability in Libcurl. Vulnerability Details Summary IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch firmware has addressed the following vulnerability in...

Security Bulletin: Vulnerabilities in cURL/libcurl affect IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru, QLogic 8Gb Intelligent Pass-thru Module & SAN Switch Module for BladeCenter and QLogic Virtual Fabric Extension Module for IBM BladeCenter

Summary IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru, QLogic 8Gb Intelligent Pass-thru Module & SAN Switch Module for BladeCenter and QLogic Virtual Fabric Extension Module for IBM BladeCenter have addressed the applicable CVEs in cURL/libcurl. Vulnerability Details Summary IBM Flex...

Security Bulletin: Vulnerabilities in cURL/libcURL affect IBM Flex System Chassis Management Module

Summary IBM Chassis Management Module has addressed the following vulnerabilities in cURL/libcURL. Vulnerability Details Summary IBM Chassis Management Module has addressed the following vulnerabilities in cURL/libcURL. Vulnerability Details CVE-ID: CVE-2016-5419 Description: cURL/libcURL could...

Information Disclosure

curl is vulnerable to Information Disclosure. The vulnerability exists due to leak authentication data to third parties which allows an attacker to impersonate the libcurl-using client's request...

Out Of Bound Reads (OOB)

libcurl.so is vulnerable to out of boundOOB reads. When an IMAP FETCH response showing the size of the returned data is zero, libcurl's deliver-data function calls the strlen function which can lead to out of bound reads on the heap and/or crashes the application...

Arbitrary Code Execution

curl is vulnerable to arbitrary code execution attacks. The vulnerability exists as multiple integer overflows in the 1 curlescape, 2 curleasyescape, 3 curlunescape, and 4 curleasyunescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length...

Cookie Leak

libcurl.so is vulnerable to cookie leak. A remote attacker is able to set or send arbitrary cookies for certain sites. libcurl.so parses IP addresses similar to domain names, where a site with an IP address of 192.168.0.1 can set or send cookies for another site ending with .168.0.1...

Information Disclosure

libcurl is vulnerable to information disclosure. The tailMatch function in cookie.c does not properly matched when sending cookies, allowing remote attackers to steal cookies via a matchign suffix in the domain of the URL...

Authentication Bypass

libcurl.so is vulnerable to authentication bypasses. The library re-uses NTLM connections, allowing a malicious user to reuse a connection to bypass authentication...

SUSE SLES12 Security Update : slurm (SUSE-SU-2017:3311-1)

This update for slurm fixes the following issues: Slurm was updated to 17.02.9 to fix a security bug, bringing new features and bugfixes fate323998 bsc1067580. Security issue fixed : - CVE-2017-15566: Fix security issue in Prolog and Epilog by always prepending SPANK to all user-set environment...

EulerOS 2.0 SP3 : curl (EulerOS-SA-2018-1401)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that curl and libcurl might send their Authentication header to a third party HTTP server upon receiving an HTTP REDIRECT reply. This...

Security Bulletin: The Community Edition of IBM ILOG CPLEX Optimization Studio is affected by a vulnerability in libcurl (CVE-2018-16840)

Summary The Community Edition of IBM ILOG CPLEX Optimization Studio on Windows platform only has addressed the following vulnerability: libcurl is vulnerable to a denial of service. Vulnerability Details CVEID: CVE-2018-16840 DESCRIPTION: cURL is vulnerable to a denial of service, caused by a hea...

curl, libcurl, nss security update

CentOS Errata and Security Advisory CESA-2018:3157 An update for curl and nss-pem is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...