Multiple vulnerabilities in cURL libcurl affect AIX

IBM SECURITY ADVISORY First Issued: Mon Dec 11 13:22:02 CST 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/curladvisory3.asc Security Bulletin: Multiple vulnerabilities in cURL libcurl affect AIX...

Security Bulletin: IBM RackSwitch firmware products are affected by a vulnerability in libcurl (CVE-2019-5436)

Summary IBM RackSwitch firmware products have addressed the following vulnerability in libcurl. Vulnerability Details CVEID: CVE-2019-5436 DESCRIPTION: cURL libcurl is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the tftpreceivepacket function. By sending over...

Security Bulletin: IBM Flex System switch firmware products are affected by a vulnerability in libcurl (CVE-2019-5436)

Summary IBM Flex System switch firmware products have addressed the following vulnerability in libcurl. Vulnerability Details CVEID: CVE-2019-5436 DESCRIPTION: cURL libcurl is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the tftpreceivepacket function. By...

Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by vulnerability in cURL/libcURL (CVE-2016-7141)

Summary IBM Integrated Management Module II IMM2 has addressed the following vulnerability in cURL/libcURL. Vulnerability Details CVEID: CVE-2016-7141 DESCRIPTION: cURL/libcURL client certificates could allow a remote attacker to bypass security restrictions, caused by an implementation error of...

Security Bulletin: IBM Dynamic System Analysis (DSA) Preboot is affected by vulnerabilities in cURL, DHCP and GNU C Library

Summary IBM Dynamic System Analysis DSA Preboot has addressed the following vulnerabilities in cURL, DHCP and GNU C Library: Vulnerability Details CVEID: CVE-2017-1000100 DESCRIPTION: cURL could allow a remote attacker with complete network control to obtain sensitive information, caused by a TFT...

Security Bulletin: Vulnerabilities in cURL/libcURL affect IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware

Summary IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware has addressed the following vulnerabilities in cURL/libcURL. Vulnerability Details CVEID: CVE-2017-1000100 DESCRIPTION: cURL could allow a remote attacker to obtain sensitive information, caused by a TFTP URL...

curl: cookie injection with none file

A flaw was found in the Curl package. This flaw allows an attacker to insert cookies into a running program using libcurl if the specific series of conditions are met...

curl: cookie injection with none file

A flaw was found in the Curl package. This flaw allows an attacker to insert cookies into a running program using libcurl if the specific series of conditions are met...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to cURL libcurl. (CVE-2023-38039)

Summary The OpenTelemetry tracing in IBM App Connect Enterprise is vulnerable to a denial of service due to cURL libcurl. CVE-2023-38039 Vulnerability Details CVEID:CVE-2023-38039 DESCRIPTION: cURL libcurl is vulnerable to a denial of service, caused by not limiting the number and size of headers...

Security Bulletin: IBM Event Streams is affected by a vulnerability in cURL libcurl (CVE-2023-28321)

Summary This security vulnerability affects the base image being used to build IBM Event Stream images. CVE-2023-28321 Vulnerability Details CVEID:CVE-2023-28321 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security restrictions, caused by a flaw when listed as "Subject...

curl: cookie injection with none file

A flaw was found in the Curl package. This flaw allows an attacker to insert cookies into a running program using libcurl if the specific series of conditions are met...

Low: Red Hat Security Advisory: curl security and bug fix update

An update for curl is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Security Bulletin: IBM QRadar Wincollect is vulnerable to using components with known vulnerabilities

Summary IBM QRadar Wincollect is vulnerable to using components with known vulnerabilities. IBM has addressed the relevant vulnerabilities Vulnerability Details CVEID:CVE-2022-25883 DESCRIPTION: Node.js semver package is vulnerable to a denial of service, caused by a regular expression denial of...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a heap-based buffer overflow due to libcurl and cURL. (CVE-2023-38546, CVE-2023-38545)

Summary The OpenTelemetry tracing in IBM App Connect Enterprise is vulnerable to a heap-based buffer overflow due to libcurl and cURL. CVE-2023-38546, CVE-2023-38545 Vulnerability Details CVEID: CVE-2023-38546 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security restrictions...

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to libcurl vulnerabilities (CVE-2023-38546, CVE-2023-38545)

Summary Issues were identified in libcurl, which is packaged with the IBM MQ Queue Manager Container image. These issues are now fixed, and the fixes are shipped with the latest IBM MQ Operator and IBM-supplied MQ Advanced container images. Vulnerability Details CVEID: CVE-2023-38546 DESCRIPTION:...

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from libcurl, glibc-minimal-langpack, glibc-common, ncurses-libs and Kubernetes

Summary Multiple issues were identified in Red Hat UBI packages, Kubernetes and go-toolset are fixed and shipped with IBM MQ Operator and IBM supplied MQ Advanced container images. Vulnerability Details CVEID: CVE-2023-4813 DESCRIPTION: glibc is vulnerable to a denial of service, caused by a...

Oracle Linux 9 : curl (ELSA-2023-6679)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6679 advisory. - unify the upload/method handling CVE-2023-28322 - fix host name wildcard checking CVE-2023-28321 - adapt the fix of CVE-2023-27535 for RHEL 9 curl -...

Oracle Linux 9 : curl (ELSA-2023-6745)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6745 advisory. - fix cookie injection with none file CVE-2023-38546 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Security Bulletin: Vulnerability with GNU glibc & libcURL affect IBM Cloud Object Storage Systems (Nov2023v1)

Summary Vulnerability with GNU glibc - CVE-2023-4911 and libcURL CVE-2023-38545 & CVE-2023-38546 This vulnerability have been addressed in the latest ClevOS releases Vulnerability Details CVEID:CVE-2023-4911 DESCRIPTION: glibc could allow a local authenticated attacker to gain elevated privileges...

curl: cookie injection with none file

A flaw was found in the Curl package. This flaw allows an attacker to insert cookies into a running program using libcurl if the specific series of conditions are met...