Updated curl packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

cURL provides the libcurl library and a command line tool for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

A heap-based buffer overflow flaw was found in the way libcurl unescaped URLs. A remote attacker could provide a specially crafted URL that, when processed by an application using libcurl that handles untrusted URLs, would possibly cause it to crash or, potentially, execute arbitrary code. (CVE-2013-2174)

Red Hat would like to thank the cURL project for reporting this issue.
Upstream acknowledges Timo Sirainen as the original reporter.

Users of curl should upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications using libcurl must be restarted for the update to take effect.

This update of curl fixes several security issues :

  - libcurl URL decode buffer boundary flaw (bnc#824517 /     CVE-2013-2174)

CVE-2013-2174 - fix heap-based buffer overflow in curl_easy_unescape()

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of curl fixes a security issue in libcurl URL buffer decoding. (bnc#824517 / CVE-2013-2174)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0030 advisory.

    This advisory aggregates security fixes for the curl SRPM in CIQ LTS 8.6. It addresses 89 CVEs:
    CVE-2019-5481, CVE-2015-3148, CVE-2021-22922, CVE-2016-5420, CVE-2021-22924, and 84 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0406 advisory.

    This advisory aggregates security fixes for the curl SRPM in CIQ LTS 9.2. It addresses 105 CVEs:
    CVE-2022-27775, CVE-2022-32221, CVE-2019-5481, CVE-2015-3148, CVE-2018-14618, and 100 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2013-506:03 advisory.

    cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using     any of the supported protocols. cURL is designed to work without user interaction or any kind of     interactivity. cURL offers many useful capabilities, like proxy support, user authentication, FTP upload,     HTTP post, and file transfer resume.
    Security issues fixed with this release:
     CVE-2013-2174     No description available at the time of writing, please check the CVE link below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0983 advisory.

    [7.19.7-37]
    - fix heap-based buffer overflow in curl_easy_unescape() (CVE-2013-2174)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201401-14 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user or automated process to connect to       a malicious server using cURL, possibly resulting in the remote execution       of arbitrary code or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1393 advisory.

    This advisory aggregates security fixes for the haproxy SRPM in CIQ LTS 9.6. It addresses 17 CVEs:
    CVE-2023-45539, CVE-2025-32464, CVE-2023-40225, CVE-2023-0836, CVE-2023-0056, and 12 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
66998	CentOS 5 / 6 : curl (CESA-2013:0983)	Nessus	CentOS Local Security Checks	2013/6/27	2021/1/4	medium
67221	SuSE 11.2 Security Update : curl (SAT Patch Number 7867)	Nessus	SuSE Local Security Checks	2013/7/10	2021/1/19	medium
67312	Fedora 19 : curl-7.29.0-7.fc19 (2013-11521)	Nessus	Fedora Local Security Checks	2013/7/12	2021/1/11	medium
68948	SuSE 11.3 Security Update : curl (SAT Patch Number 7932)	Nessus	SuSE Local Security Checks	2013/7/18	2021/1/19	medium
359305	Rocky Linux 8.6 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / curl-minimal / etc Multiple Vulnerabilities (ciqsa-2026_0030)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
356987	Rocky Linux 9.2 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / curl-minimal / etc Multiple Vulnerabilities (ciqsa-2026_0406)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/13	critical
291482	MiracleLinux 4 : curl-7.19.7-37.AXS4 (AXSA:2013-506:03)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	critical
68841	Oracle Linux 5 / 6 : curl (ELSA-2013-0983)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical
68998	Fedora 17 : curl-7.24.0-10.fc17 (2013-11568)	Nessus	Fedora Local Security Checks	2013/7/23	2021/1/11	medium
72053	GLSA-201401-14 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2014/1/21	2021/1/6	high
356264	Rocky Linux 9.6 [CIQ] Security Update: haproxy Multiple Vulnerabilities (ciqsa-2026_1393)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical

检测

插件搜索

medium

medium

medium

medium

critical

critical

critical

critical

medium

high

critical