2423 matches found
curl: HTTP/2 push headers memory-leak
A flaw was found in curl. When an application configures libcurl to use HTTP/2 server push and the amount of received headers for the push surpasses the maximum allowed limit, libcurl aborts the server push. When aborting, libcurl does not free all the previously allocated headers, resulting in a...
curl: HTTP/2 push headers memory-leak
A flaw was found in curl. When an application configures libcurl to use HTTP/2 server push and the amount of received headers for the push surpasses the maximum allowed limit, libcurl aborts the server push. When aborting, libcurl does not free all the previously allocated headers, resulting in a...
SUSE SLES15 Security Update : curl (SUSE-SU-2024:1151-2)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1151-2 advisory. - CVE-2024-2004: Fix the uUsage of disabled protocol logic. bsc1221665 - CVE-2024-2398: Fix HTTP/2 push headers memory-leak...
CVE-2024-34369 WordPress Web Push Notifications – Webpushr plugin <= 4.35.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Webpushr Web Push Notifications Webpushr allows Reflected XSS.This issue affects Webpushr: from n/a through 4.35.0...
SUSE-SU-2024:1151-2 Security update for curl
This update for curl fixes the following issues: - CVE-2024-2004: Fix the uUsage of disabled protocol logic. bsc1221665 - CVE-2024-2398: Fix HTTP/2 push headers memory-leak. bsc1221667...
Arbitrary Code Execution
Mercurial is vulnerable to a Arbitrary Code Execution. The vulnerability is due to incorrect bound checks in the binary delta decoder which allows an attacker to execute arbitrary code via a clone, push, or pull command, related to either list sizing rounding error or short records...
Medium: curl
Issue Overview: When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protoco...
Medium: curl
Issue Overview: When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protoco...
USN-6718-3 curl vulnerabilities
USN-6718-1 fixed vulnerabilities in curl. This update provides the corresponding updates for Ubuntu 24.04 LTS. Original advisory details: Dan Fandrich discovered that curl would incorrectly use the default set of protocols when a parameter option disabled all protocols without adding any, contrar...
Ubuntu 24.04 LTS. : curl vulnerabilities (USN-6718-3)
The remote Ubuntu 24.04 LTS. host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6718-3 advisory. USN-6718-1 fixed vulnerabilities in curl. This update provides the corresponding updates for Ubuntu 24.04 LTS. Tenable has extracted the preceding...
Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2024-596)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-596 advisory. When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing...
Drupal Advanced PWA inc Push Notifications module < 1.5.0 - Authenticated Broken Access Control vulnerability
Authenticated Broken Access Control vulnerability discovered by Andre Groendijk in WordPress Module Advanced PWA inc Push Notifications versions 1.5.0...
OESA-2024-1480 curl security update
cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum...
CVE-2024-32473 vulnerabilities
Vulnerabilities for packages: docker, kaniko, harbor-scanner-trivy-fips, policy-controller, syft, helm-push, cri-tools, k3d, neuvector-scanner, docker-compose, dagger, buf, grype, wolfictl, melange, policy-controller-fips, harbor-scanner-trivy...
CVE-2024-32473 vulnerabilities
Vulnerabilities for packages: kaniko, harbor-scanner-trivy, grype, k3d, policy-controller, docker, neuvector-scanner, wolfictl, helm-push, docker-compose, syft, dagger, buf, melange, cri-tools...
GHSA-X84C-P2G9-RQV9 vulnerabilities
Vulnerabilities for packages: docker, kaniko, harbor-scanner-trivy-fips, policy-controller, syft, helm-push, cri-tools, k3d, neuvector-scanner, docker-compose, dagger, buf, grype, wolfictl, melange, policy-controller-fips, harbor-scanner-trivy...
GHSA-X84C-P2G9-RQV9 vulnerabilities
Vulnerabilities for packages: kaniko, harbor-scanner-trivy, grype, k3d, policy-controller, docker, neuvector-scanner, wolfictl, helm-push, docker-compose, syft, dagger, buf, melange, cri-tools...
CLSA-2024-1713333661 Fix CVE(s): CVE-2024-2398
SECURITY UPDATE: - debian/patches/CVE-2024-2398.patch: http2: push headers better cleanup provide common cleanup method for push headers - CVE-2024-2398...
OESA-2024-1412 curl security update
cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum...