3890 matches found
Amazon Linux 2 : curl (ALAS-2019-1233)
An integer overflow in curl's URL API results in a buffer overflow in libcurl. CVE-2019-5435 A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl. CVE-2019-5436 C Tenable Network Security, Inc. The descriptive text and package checks in this plug...
Low: curl
Issue Overview: An integer overflow in curl's URL API results in a buffer overflow in libcurl. CVE-2019-5435 A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl. CVE-2019-5436 Affected Packages: curl Note: This advisory is applicable to Amazon...
EulerOS Virtualization for ARM 64 3.0.2.0 : curl (EulerOS-SA-2019-1696)
According to the version of the curl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy...
curl: Libcurl ocasionally sends HTTPS traffic to port 443 rather than specified port 8080
Summary: We have encountered an issue with libcurl where, under certain network conditions, the library will attempt to submit data to an incorrect port as was set by CURLOPTPORT. As information is sent to an unauthorised port, we consider this an information disclosure issue. Our security softwa...
curl: HTTP authentication leak in redirects
It was found that curl and libcurl might send their Authentication header to a third party HTTP server upon receiving an HTTP REDIRECT reply. This could leak authentication token to external entities...
curl: FTP path trickery leads to NIL byte out of bounds write
It was found that libcurl did not safely parse FTP URLs when using the CURLOPTFTPFILEMETHOD method. An attacker, able to provide a specially crafted FTP URL to an application using libcurl, could write a NULL byte at an arbitrary location, resulting in a crash or an unspecified behavior...
A vulnerability exists in the curl_url_set() function of the libcurl library, related to integer overflow. This vulnerability allows an attacker to compromise the accessibility of the protected information.
The vulnerability in the curlurlset function of the libcurl library is related to a potential overflow condition. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information...
PT-2019-3585
Name of the Vulnerable Software and Affected Versions curl versions 7.65.1 and earlier MySQL Server versions 5.7.27 and earlier, 8.0.17 and earlier Description The issue is related to incorrect code generation management in the libcurl library. It allows a non-privileged user or program to place...
Man-in-the-Middle (MitM)
libcurl.so is vulnerable to man-in-the-middle attacks. The library recognizes a wildcard IP address in the subject's Common Name CN field of an X.509 certificate. This allows a remote attacker to spoof SSL servers using malicious certifacte issued by a legitimate CA and perform a man-in-the-middl...
MAN-IN-THE-MIDDLE
libcurl.so is vulnerable to man-in-the-middle attack. A lack of validation of the TLS certificate and hostname in the mbedconnectstep1 function in lib/vtls/mbedtls.c and polarsslconnectstep1 function in lib/vtls/polarssl.c allows a remote attacker to spoof servers and perform man-in-the-middle...
[ASA-201905-12] libcurl-gnutls: arbitrary code execution
Arch Linux Security Advisory ASA-201905-12 ========================================== Severity: High Date : 2019-05-31 CVE-ID : CVE-2019-5436 Package : libcurl-gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-960 Summary ======= The package...
[ASA-201905-11] libcurl-compat: arbitrary code execution
Arch Linux Security Advisory ASA-201905-11 ========================================== Severity: High Date : 2019-05-31 CVE-ID : CVE-2019-5436 Package : libcurl-compat Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-959 Summary ======= The package...
[ASA-201905-13] lib32-libcurl-gnutls: arbitrary code execution
Arch Linux Security Advisory ASA-201905-13 ========================================== Severity: High Date : 2019-05-31 CVE-ID : CVE-2019-5435 CVE-2019-5436 Package : lib32-libcurl-gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-961 Summary ======= The...
[ASA-201905-14] lib32-libcurl-compat: arbitrary code execution
Arch Linux Security Advisory ASA-201905-14 ========================================== Severity: High Date : 2019-05-31 CVE-ID : CVE-2019-5435 CVE-2019-5436 Package : lib32-libcurl-compat Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-962 Summary ======= The...
ALPINE-CVE-2019-5435
An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1...
DEBIAN-CVE-2019-5435
An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1...
ALPINE-CVE-2019-5436
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1...
DEBIAN-CVE-2019-5436
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1...
