openSUSE: Security Advisory for curl (openSUSE-SU-2014:1139-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

curl (important)

libcurl was updated to fix security issues: CVE-2014-3613: Cookies for hosts specified by numeric IP could be assigned or used for other numeric IP hosts if portions of the numerics were the same. CVE-2014-3620: libcurl allowed cookies to be set for toplevel domains, making them to broad...

Medium: curl

Issue Overview: libcurl wrongly allows cookies to be set for TLDs, thus making them much broader then they are supposed to be allowed to. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain. By not detecting and rejecting domain names...

libcurl information leakage

Cookie can be leaked to wrong site...

cURL/libcURL Cookie handling remote security bypass Vulnerability(CVE-2 0 1 4-3 6 2 0)-vulnerability warning-the black bar safety net

Affected system: cURL cURL 7.31.0 - 7.37.1 Description: BUGTRAQ ID: 6 9 7 4 2 CVECAN ID: CVE-2 0 1 4-3 6 2 0 cURL/libcURL is a command-line file transfer tool that supports FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE and LDAP. cURL/libcURL 7.31.0 - 7.37.1 version error for TLD set a cookie...

cURL/libcURL 7.x < 7.38.0 Multiple Vulnerabilities

Binary data 8385.prm...

cookie leak with IP address as domain

By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP cookies, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others. For this problem to trigger, the client application...

cookie leak for TLDs

libcurl wrongly allows cookies to be set for Top Level Domains TLDs, thus making them apply broader than cookies are allowed. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain...

CURL-CVE-2014-3620 cookie leak for TLDs

libcurl wrongly allows cookies to be set for Top Level Domains TLDs, thus making them apply broader than cookies are allowed. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain...

CURL-CVE-2014-3613 cookie leak with IP address as domain

By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP cookies, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others. For this problem to trigger, the client application...

CVE-2014-3613

cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1...

UBUNTU-CVE-2014-3613

cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1...

UBUNTU-CVE-2014-3620

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain...

CVE-2014-3620

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain...

Debian: Security Advisory (DSA-3022-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

cURL Buffer Overflow Vulnerability

No description provided by source. cURL buffer overflow Wed 06 February 2013 Volema found remotely exploitable buffer overflow vulnerability in libcurl POP3, SMTP protocol handlers which lead to code execution RCE. When negotiating SASL DIGEST-MD5 authentication, the function...

openSUSE Security Update : curl (openSUSE-SU-2014:0598-1)

This curl update fixes two security issues : - bnc868627: Fixed wrong re-use of connections CVE-2014-0138. - bnc868629: Fixed IP address wildcard certificate validation CVE-2014-0139. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openSUSE Security Update : curl (openSUSE-SU-2013:0876-1)

libcurl was updated to fix a cookie tail matching flaw which could lead to attackers gaining cookie access depending on domain names. CVE-2013-1944,bnc814655 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

openSUSE Security Update : curl / libcurl (openSUSE-SU-2013:1132-1)

A vulnerability was discovered for the curl and libcurl packages in openSUSE versions 12.2 and 12.3. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2013-552. The text description of...

openSUSE Security Update : curl (openSUSE-SU-2013:1859-1)

This update fixes the following security issues with curl : - fix CVE-2013-4545 bnc849596 = acknowledge VERIFYHOST without VERIFYPEER %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...