CVE-2017-13090

The connected documents confirm CVE-2017-13090 affects wget prior to 1.19.2, due to chunked HTTP processing in retr.c:fd_read_body(). The chunk parser uses strtol() to read chunk lengths but does not validate non-negativity; then reads chunks with MIN(..) and passes a negative length to fd_read()...

CVE-2017-13089

The http.c:skipshortbody function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then...

CVE-2017-13089

The http.c:skipshortbody function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then...

CVE-2017-13089

The http.c:skipshortbody function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then...

CVE-2017-13090

The retr.c:fdreadbody function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in piec...

PHP Server Side Request Forgery Security Bypass Vulnerability（CVE-2017-7272）

For historical reasons, fsockopen accepts the port and hostname separately: fsockopen'127.0.0.1', 80 However, with the introdcution of stream transports in PHP 4.3, it became possible to include the port in the hostname specifier: fsockopen'127.0.0.1:80' Or more formally:...

深澜Srun 3000 安全认证网络管理计费系统客户端拒绝服务漏洞

简要描述： 深澜Srun 3000 安全认证客户端存在拒绝服务漏洞 详细说明： 导致拒绝服务问题的函数是sub4015C0 如上， v9 = strtolconst char &v19, 0, 16 strtol函数将V19转换成有符号数后赋值给v9，而v9为无符号数。在将有符号数转换为无符号数时没有加验证，因此如果v19为字符串“-1”，转换后的v9就会变成0xFFFFFFFF，接下来的字符串拷贝操作strncpy&Src, v15, v9;就会导致拷贝长度出错，从而导致拒绝服务的产生。 漏洞证明： 无。...