Moderate: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: Content not matching hash in Metalink is not being discarded CVE-2021-22922 curl: Metalink download sends credentials...

Slackware Linux 14.0 / 14.1 / 14.2 / current curl Multiple Vulnerabilities (SSA:2021-258-01)

The version of curl installed on the remote host is prior to 7.79.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2021-258-01 advisory. - When curl = 7.20.0 and = 7.20.0 and = 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP...

CURL-CVE-2021-22945 UAF and double free in MQTT sending

When sending data to an MQTT server, libcurl could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it again...

CVE-2021-22945

A flaw was found in libcurl. When sending data to an MQTT server could in some situations lead to libcurl using already freed memory and then try to free it again. The highest threat from this vulnerability is to data confidentiality as well as system availability...

CVE-2021-22945

When sending data to an MQTT server, libcurl = 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it again...

libcurl 安全漏洞

HAXX Haxx libcurl is a free, open source client-side URL transport library from the Swedish company HAXX. The library supports FTP, FTPS, TFTP, HTTP and more. There is a security vulnerability in Haxx curl, there is no information about this vulnerability, please feel free to pay attention to CNN...

libcurl 资源管理错误漏洞

HAXX Haxx libcurl is a free, open source client-side URL transport library from the Swedish company HAXX. The library supports FTP, FTPS, TFTP, HTTP and more. Haxx libcurl suffers from a resource management error vulnerability that arises from mismanagement of system resources e.g., memory, disk...

PT-2021-5208

Name of the Vulnerable Software and Affected Versions libcurl versions 7.73.0 and 7.78.0 Description The issue is related to a boundary error when sending data to an MQTT server. This can lead to a double-free error, allowing a remote attacker to perform a denial-of-service DoS attack. The proble...

Medium: curl

Issue Overview: A flaw was found in curl in the way curl handles a file hash mismatch after downloading content using the Metalink feature. This flaw allows malicious actors controlling a hosting server to trick users into downloading malicious content. The highest threat from this vulnerability ...

UBUNTU-CVE-2021-22945

When sending data to an MQTT server, libcurl = 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it again...

Ubuntu 18.04 LTS / 20.04 LTS : curl vulnerabilities (USN-5079-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5079-1 advisory. It was discovered that curl incorrect handled memory when sending data to an MQTT server. A remote attacker could use this issue to cause cur...

EulerOS 2.0 SP2 : curl (EulerOS-SA-2021-2364)

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPTTELNETOPTIONS in libcurl, is used to...

Amazon Linux AMI : curl (ALAS-2021-1525)

The version of curl installed on the remote host is prior to 7.61.1-12.99. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1525 advisory. A flaw was found in libcurl in the way libcurl handles previously used connections without accounting for 'issuer cert' and...

Medium: curl

Issue Overview: A flaw was found in libcurl in the way libcurl handles previously used connections without accounting for 'issuer cert' and comparing the involved paths case-insensitively. This flaw allows libcurl to use the wrong connection. The highest threat from this vulnerability is to...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2021-2325)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Update of libcurl-devel, libcurl-devel, libcurl, curl, libcurl

...

Debian DLA-2734-1 : curl - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2734 advisory. - curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPTTELNETOPTIONS in libcurl, is used to send...

Security Bulletin: A vulnerability was identified and remediated in the IBM MaaS360 Cloud Extender (V2.103.000.051) and Modules

Summary A vulnerability was identified and remediated in the IBM MaaS360 Cloud Extender Agent V2.103.000.051 and Modules. Vulnerability Details CVEID: CVE-2021-22890 DESCRIPTION: cURL libcurl is vulnerable to a man-in-the-middle attack, caused by a session tickets confusing issue when using a HTT...

CVE-2021-22926

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the CURLOPTSSLCERT option --cert with the command line tool.When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificat...

DEBIAN-CVE-2021-22924

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths case insensitively,which could lead ...