- fix floating point buffer overflow issues     (CVE-2016-9586)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libcurl's implementation of the printf() functions triggers a buffer overflow when doing a large floating point output. The bug occurs when the conversion outputs more than 255 bytes.

The flaw happens because the floating point conversion is using system functions without the correct boundary checks.

If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.

This flaw does not exist in the command line tool.

For Debian 7 'Wheezy', these problems have been fixed in version 7.26.0-1+wheezy18.

We recommend that you upgrade your curl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-47 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers and bug reports referenced for details.
  Impact :

    Remote attackers could conduct a Man-in-the-Middle attack to obtain       sensitive information, cause a Denial of Service condition, or execute       arbitrary code.
  Workaround :

    There is no known workaround at this time.

This update for curl fixes the following issues: These security issues were fixed :

  - CVE-2016-9586: libcurl printf floating point buffer     overflow (bsc#1015332)

  - CVE-2017-7407: The ourWriteOut function in     tool_writeout.c in curl might have allowed physically     proximate attackers to obtain sensitive information from     process memory in opportunistic circumstances by reading     a workstation screen during use of a --write-out     argument ending in a '%' character, which lead to a     heap-based buffer over-read (bsc#1032309).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in cURL, an URL transfer library.

CVE-2016-7141

When built with NSS and the libnsspem.so library is available at runtime, allows an remote attacker to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420.

CVE-2016-7167

Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.

CVE-2016-9586

Curl is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any applications that accept a format string from the outside without necessary input filtering, it could allow remote attacks.

CVE-2018-16839

Curl is vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

CVE-2018-16842

Curl is vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

For Debian 8 'Jessie', these problems have been fixed in version 7.38.0-4+deb8u13.

We recommend that you upgrade your curl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in     libcurl's implementation of the printf() functions. If there are any application that accepts a format     string from the outside without necessary input filtering, it could allow remote attacks. (CVE-2016-9586)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3745:01 advisory.

    * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for     CGI applications (CVE-2018-1283)
    * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)
    * httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)
    * httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)
    * httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values     (CVE-2017-15710)
    * httpd:  bypass with a trailing newline in the file name (CVE-2017-15715)
    * httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)
    * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)
    * curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421,     CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619,     CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816,     CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301,     CVE-2018-14618)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for curl fixes the following issues: Security issue fixed :

  - CVE-2016-9586: libcurl printf floating point buffer     overflow (bsc#1015332)

  - CVE-2017-7407: The ourWriteOut function in     tool_writeout.c in curl might have allowed physically     proximate attackers to obtain sensitive information from     process memory in opportunistic circumstances by reading     a workstation screen during use of a --write-out     argument ending in a '%' character, which lead to a     heap-based buffer over-read (bsc#1032309). With this     release new default ciphers are active (SUSE_DEFAULT,     bsc#1027712).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running Mac OS X 10.10.5, Mac OS X 10.11.6, or macOS 10.12.5 and is missing a security update. It is therefore, affected by multiple vulnerabilities :

  - An overflow condition exists in the curl component in     the dprintf_formatf() function that is triggered when     handling floating point conversion. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-9586)

  - A flaw exits in the curl component in the randit()     function within file lib/rand.c due to improper     initialization of the 32-bit random value, which is     used, for example, to generate Digest and NTLM     authentication nonces, resulting in weaker cryptographic     operations than expected. (CVE-2016-9594)

  - A flaw exists in the curl component in the     allocate_conn() function in lib/url.c when using the     OCSP stapling feature for checking a X.509 certificate     revocation status. The issue is triggered as the request     option for OCSP stapling is not properly passed to the     TLS library, resulting in no error being returned even     when no proof of the validity of the certificate could     be provided. A man-in-the-middle attacker can exploit     this to provide a revoked certificate. (CVE-2017-2629)

  - A remote code execution vulnerability exists in the     CoreAudio component due to improper validation of     user-supplied input when handling movie files. An     unauthenticated, remote attacker can exploit this, by     convincing a user to play a specially crafted movie     file, to cause a denial of service condition or the     execution of arbitrary code. (CVE-2017-7008)

  - A memory corruption issue exists in the IOUSBFamily     component due to improper validation of user-supplied     input. A local attacker can exploit this, via a     specially crafted application, to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-7009)

  - Multiple out-of-bounds read errors exist in the libxml2     component due to improper handling of specially crafted     XML documents. An unauthenticated, remote attacker can     exploit these to disclose user information.
    (CVE-2017-7010, CVE-2017-7013)

  - Multiple memory corruption issues exist in the Intel     Graphics Driver component due to improper validation of     input. A local attacker can exploit these issues to     execute arbitrary code with elevated privileges.
    (CVE-2017-7014, CVE-2017-7017, CVE-2017-7035,     CVE-2017-7044)

  - A remote code execution vulnerability exists in the     Audio component due to improper validation of     user-supplied input when handling audio files. An     unauthenticated, remote attacker can exploit this, by     convincing a user to play a specially crafted audio     file, to execute arbitrary code. (CVE-2017-7015)

  - Multiple remote code execution vulnerabilities exist in     the afclip component due to improper validation of     user-supplied input when handling audio files. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to play a     specially crafted audio file, to execute arbitrary     code. (CVE-2017-7016, CVE-2017-7033)

  - A memory corruption issue exists in the     AppleGraphicsPowerManagement component due to improper     validation of input. A local attacker can exploit this     to cause a denial of service condition or the execution     of arbitrary code with system privileges.
    (CVE-2017-7021)

  - Multiple memory corruption issues exist in the kernel     due to improper validation of input. A local attacker     can exploit these issues to cause a denial of service     condition or the execution of arbitrary code with system     privileges. (CVE-2017-7022, CVE-2017-7024,     CVE-2017-7026)

  - Multiple memory corruption issues exist in the kernel     due to improper validation of input. A local attacker     can exploit these issues to cause a denial of service     condition or the execution of arbitrary code with kernel     privileges. (CVE-2017-7023, CVE-2017-7025,     CVE-2017-7027, CVE-2017-7069)

  - Multiple unspecified flaws exist in the kernel due to a     failure to properly sanitize input. A local attacker can     exploit these issues, via a specially crafted     application, to disclose restricted memory contents.
    (CVE-2017-7028, CVE-2017-7029, CVE-2017-7067)

  - A flaw exists in the Foundation component due to     improper validation of input. A unauthenticated, remote     attacker can exploit this, by convincing a user to open     specially crafted file, to execute arbitrary code.
    (CVE-2017-7031)

  - A memory corruption issue exists in the 'kext tools'     component due to improper validation of input. A local     attacker can exploit this to execute arbitrary code with     elevated privileges. (CVE-2017-7032)

  - Multiple unspecified flaws exist in the Intel Graphics     Driver component due to a failure to properly sanitize     input. A local attacker can exploit these issues, via a     specially crafted application, to disclose restricted     memory contents. (CVE-2017-7036, CVE-2017-7045)

  - A memory corruption issue exists in the libxpc component     due to improper validation of input. A local attacker     can exploit this issue, via a specifically crafted     application, to cause a denial of service condition or     the execution of arbitrary code with system privileges.
    (CVE-2017-7047)

  - Multiple memory corruption issues exist in the     Bluetooth component due to improper validation of input.
    A local attacker can exploit these issues to execute     arbitrary code with system privileges. (CVE-2017-7050,     CVE-2017-7051)

  - A memory corruption issue exists in the Bluetooth     component due to improper validation of input. A local     attacker can exploit these issues to execute arbitrary     code with system privileges. (CVE-2017-7054)

  - A buffer overflow condition exists in the Contacts     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2017-7062)

  - A buffer overflow condition exists in the libarchive     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this, via a specially crafted archive file, to cause a     denial of service condition or the execution of     arbitrary code. (CVE-2017-7068)

  - A certificate validation bypass vulnerability exists in     the curl component due to the program attempting to     resume TLS sessions even if the client certificate     fails. An unauthenticated, remote attacker can exploit     this to bypass validation mechanisms. (CVE-2017-7468)

  - A memory corruption issue exists in the Broadcom BCM43xx     family Wi-Fi Chips component that allows an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2017-9417)

This update for curl fixes the following issues :

  - CVE-2017-1000100: TFP sends more than buffer size and it     could lead to a denial of service (bsc#1051644)

  - CVE-2017-7407: ourWriteOut function problem could lead     to a heap buffer over-read (bsc#1032309)

  - CVE-2016-9586: libcurl printf issue could lead to buffer     overflow (bsc#1015332)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3739:01 advisory.

    * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for     CGI applications (CVE-2018-1283)
    * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)
    * httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)
    * httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)
    * httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values     (CVE-2017-15710)
    * httpd:  bypass with a trailing newline in the file name (CVE-2017-15715)
    * httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)
    * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)
    * curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421,     CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619,     CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816,     CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301,     CVE-2018-14618)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for curl fixes the following issues :

Security issue fixed :

  - CVE-2016-9586: libcurl printf floating point buffer     overflow (bsc#1015332)

  - CVE-2017-7407: The ourWriteOut function in     tool_writeout.c in curl might have allowed physically     proximate attackers to obtain sensitive information from     process memory in opportunistic circumstances by reading     a workstation screen during use of a --write-out     argument ending in a '%' character, which lead to a     heap-based buffer over-read (bsc#1032309).

With this release new default ciphers are active (SUSE_DEFAULT, bsc#1027712).

This update was imported from the SUSE:SLE-12:Update update project.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3558 advisory.

    The Apache HTTP Server is a powerful, efficient, and extensible web server. The httpd24 packages provide a     recent stable release of version 2.4 of the Apache HTTP Server, along with the mod_auth_kerb module.

    The following packages have been upgraded to a later upstream version: httpd24-httpd (2.4.34),     httpd24-curl (7.61.1). (BZ#1590833, BZ#1648928)

    Security Fix(es):

    * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for     CGI applications (CVE-2018-1283)

    * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)

    * httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)

    * httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)

    * httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values     (CVE-2017-15710)

    * httpd: <FilesMatch> bypass with a trailing newline in the file name (CVE-2017-15715)

    * httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)

    * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)

    * curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421,     CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619,     CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816,     CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301,     CVE-2018-14618)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the Curl project for reporting CVE-2017-8816, CVE-2017-8817, CVE-2017-1000254,     CVE-2017-1000257, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000122, CVE-2018-1000301, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2018-14618, and CVE-2018-1000121. Upstream acknowledges Alex     Nichols as the original reporter of CVE-2017-8816; the OSS-Fuzz project as the original reporter of     CVE-2017-8817 and CVE-2018-1000301; Max Dymond as the original reporter of CVE-2017-1000254 and     CVE-2018-1000122; Brian Carpenter and the OSS-Fuzz project as the original reporters of CVE-2017-1000257;
    Craig de Stigter as the original reporter of CVE-2018-1000007; Duy Phan Thanh as the original reporter of     CVE-2018-1000120; Even Rouault as the original reporter of CVE-2017-1000100; Brian Carpenter as the     original reporter of CVE-2017-1000101; Zhaoyang Wu as the original reporter of CVE-2018-14618; and Dario     Weisser as the original reporter of CVE-2018-1000121.

    Bug Fix(es):

    * Previously, the Apache HTTP Server from the httpd24 Software Collection was unable to handle situations     when static content was repeatedly requested in a browser by refreshing the page. As a consequence, HTTP/2     connections timed out and httpd became unresponsive. This bug has been fixed, and HTTP/2 connections now     work as expected in the described scenario. (BZ#1518737)

    Enhancement(s):

    * This update adds the mod_md module to the httpd24 Software Collection. This module enables managing     domains across virtual hosts and certificate provisioning using the Automatic Certificate Management     Environment (ACME) protocol. The mod_md module is available only for Red Hat Enterprise Linux 7.
    (BZ#1640722)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Software Collections 3.2 Release     Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
96160	Fedora 25 : curl (2016-edbb33ab2e)	Nessus	Fedora Local Security Checks	2016/12/28	2026/1/7	high
96183	Debian DLA-767-1 : curl security update	Nessus	Debian Local Security Checks	2017/1/3	2026/1/7	high
96644	GLSA-201701-47 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/1/20	2026/1/5	critical
99465	SUSE SLES11 Security Update : curl (SUSE-SU-2017:1043-1)	Nessus	SuSE Local Security Checks	2017/4/19	2025/12/25	high
118753	Debian DLA-1568-1 : curl security update	Nessus	Debian Local Security Checks	2018/11/7	2024/7/25	critical
220327	Linux Distros Unpatched Vulnerability : CVE-2016-9586	Nessus	Misc.	2025/3/4	2025/9/30	high
289425	MiracleLinux 4 : httpd24-nghttp2-1.7.1-7.AXS4, httpd24-curl-7.61.1-1.AXS4, httpd24-httpd-2.4.34-7.AXS4 (AXSA:2019-3745:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
99464	SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2017:1042-1)	Nessus	SuSE Local Security Checks	2017/4/19	2025/12/25	high
101957	macOS and Mac OS X Multiple Vulnerabilities (Security Update 2017-003)	Nessus	MacOS X Local Security Checks	2017/7/25	2025/12/9	critical
102910	SUSE SLES11 Security Update : curl (SUSE-SU-2017:2312-1)	Nessus	SuSE Local Security Checks	2017/9/1	2025/11/24	high
289086	MiracleLinux 7 : httpd24-nghttp2-1.7.1-7.el7, httpd24-curl-7.61.1-1.el7, httpd24-httpd-2.4.34-7.el7 (AXSA:2019-3739:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
96209	Fedora 24 : curl (2016-86d2b5aefb)	Nessus	Fedora Local Security Checks	2017/1/3	2026/1/7	high
99702	openSUSE Security Update : curl (openSUSE-2017-513)	Nessus	SuSE Local Security Checks	2017/4/27	2025/12/23	high
194113	RHEL 6 / 7 : httpd24 (RHSA-2018:3558)	Nessus	Red Hat Local Security Checks	2024/4/27	2025/3/16	critical

检测

插件搜索

high

high

critical

high

critical

high

critical

high

critical

high

critical

high

high

critical