The remote host is affected by the vulnerability described in GLSA-201203-02 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in cURL:
      When zlib is enabled, the amount of data sent to an application for         automatic decompression is not restricted (CVE-2010-0734).
      When performing GSSAPI authentication, credential delegation is         always used (CVE-2011-2192).
      When SSL is enabled, cURL improperly disables the OpenSSL workaround         to mitigate an information disclosure vulnerability in the SSL and TLS         protocols (CVE-2011-3389).
      libcurl does not properly verify file paths for escape control         characters in IMAP, POP3 or SMTP URLs (CVE-2012-0036).
  Impact :

    A remote attacker could entice a user or automated process to open a       specially crafted file or URL using cURL, possibly resulting in the       remote execution of arbitrary code, a Denial of Service condition,       disclosure of sensitive information, or unwanted actions performed via       the IMAP, POP3 or SMTP protocols. Furthermore, remote servers may be able       to impersonate clients via GSSAPI requests.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities has been found and corrected in curl :

curl is vulnerable to a SSL CBC IV vulnerability when built to use OpenSSL for the SSL/TLS layer. A work-around has been added to mitigate the problem (CVE-2011-3389).

curl is vulnerable to a data injection attack for certain protocols through control characters embedded or percent-encoded in URLs (CVE-2012-0036).

The updated packages have been patched to correct these issues.

- Fix IMAP, POP3 and SMTP URL sanitization (bnc#740452,     CVE-2012-0036)

  - Disable SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option     when built against an older OpenSSL version     (CVE-2010-4180).

  - Don't enable SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS     (bnc#742306, CVE-2011-3389).

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0030 advisory.

    This advisory aggregates security fixes for the curl SRPM in CIQ LTS 8.6. It addresses 89 CVEs:
    CVE-2019-5481, CVE-2015-3148, CVE-2021-22922, CVE-2016-5420, CVE-2021-22924, and 84 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0406 advisory.

    This advisory aggregates security fixes for the curl SRPM in CIQ LTS 9.2. It addresses 105 CVEs:
    CVE-2022-27775, CVE-2022-32221, CVE-2019-5481, CVE-2015-3148, CVE-2018-14618, and 100 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
58212	GLSA-201203-02 : cURL: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	2012/3/6	2022/12/5	high
58759	Mandriva Linux Security Advisory : curl (MDVSA-2012:058)	Nessus	Mandriva Local Security Checks	2012/4/16	2022/12/5	high
74807	openSUSE Security Update : curl (openSUSE-2012-76) (BEAST)	Nessus	SuSE Local Security Checks	2014/6/13	2022/12/5	high
359305	Rocky Linux 8.6 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / curl-minimal / etc Multiple Vulnerabilities (ciqsa-2026_0030)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
356987	Rocky Linux 9.2 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / curl-minimal / etc Multiple Vulnerabilities (ciqsa-2026_0406)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/13	critical

检测

插件搜索

high

high

high

critical

critical