CVE-2018-1000005: Out-of-bounds Read

libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported https://github.com/curl/curl/pull/2231 that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the...

CVE-2018-1000007

libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is...

cURL/libcURL CVE-2018-1000007 Information Disclosure Vulnerability

Description cURL/libcURL is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. curl 6.0 through 7.57.0 are vulnerable. Technologies Affected Haxx Curl 6.0 Haxx Curl 6.1 Haxx Curl 6.4 Haxx Cu...

UBUNTU-CVE-2018-1000005

libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported https://github.com/curl/curl/pull/2231 that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the...

CVE-2018-1000005

libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported https://github.com/curl/curl/pull/2231 that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the...

CVE-2018-1000007: Undefined Security Weakness

libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is...

PT-2018-9197

Name of the Vulnerable Software and Affected Versions: libcurl versions 7.49.0 through 7.57.0 Description: The issue is related to an out-of-bounds read in the code handling HTTP/2 trailers. This occurs because the stored size of the trailer data is one byte less than required, causing the data t...

Medium: curl

Issue Overview: The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service integer overflow and resultant buffer overflow, and application crash or possibly have unspecified other impact via vectors involving long user and...

F5 Networks BIG-IP : cURL and libcurl vulnerability (K01006862)

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.CVE-2016-8615 Impact When a cURL connection stores a...

F5 Networks BIG-IP : libcurl vulnerability (K10196624)

The libcurl API function called curlmaprintf before version 7.51.0 can be tricked into doing a double-free due to an unsafe sizet multiplication, on systems using 32 bit sizet variables. CVE-2016-8618 Impact A custom monitor or script that calls the curl command may allow unauthorized disclosure ...

F5 Networks BIG-IP : libcurl vulnerability (K44503763)

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via CURLOPTUSERNAME. CVE-2016-8617 Impact This vulnerability may allow an attacker to overwrite memory behind the output buffer. C Tenable...

F5 Networks BIG-IP : cURL and libcurl vulnerability (K84940705)

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure. CVE-2016-8623 Impact A use-after-free can occur with shared cookies, allowing a user or processunauthorized access to view or replace...

F5 Networks BIG-IP : cURL and libcurl vulnerability (K85235351)

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC t...

F5 Networks BIG-IP : libcurl vulnerability (K26899353)

The curlgetdate function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short. CVE-2016-8621 Impact Custom monitors or shell scripts using curl to download content with a malformed time stamp may be vulnerable to a privilege escalation....

F5 Networks BIG-IP : libcurl vulnerability (K52828640)

A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped...

Haxx curl and libcurl out-of-bounds read denial of service vulnerability

Haxx curl and libcurl are both products of the Swedish company Haxx. curl is a set of file transfer tools that utilize URL syntax to work at the command line. libcurl is a free, open source client-side URL transfer library. An out-of-bounds read denial of service vulnerability exists in Haxx curl...

EulerOS 2.0 SP2 : curl (EulerOS-SA-2017-1288)

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in anonymous or not,...

EulerOS 2.0 SP2 : curl (EulerOS-SA-2017-1313)

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A buffer overrun flaw was found in the IMAP handler of libcurl. By tricking an unsuspecting user into connecting to a malicious IMAP server, an...

EulerOS 2.0 SP1 : curl (EulerOS-SA-2017-1287)

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in anonymous or not,...

Debian DLA-1195-1 : curl security update

CVE-2017-8817 Fuzzing by the OSS-Fuzz project led to the discovery of a read out of bounds flaw in the FTP wildcard function in libcurl. A malicious server could redirect a libcurl-based client to an URL using a wildcard pattern, triggering the out-of-bound read. For Debian 7 'Wheezy', these...