- SASL password overflow via integer overflow     (CVE-2018-16839)

  - fix use-after-free in handle close (CVE-2018-16840)

  - fix bad arethmetic when outputting warnings to stderr     (CVE-2018-16842)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl fixes the following issues :

Security issues fixed :

CVE-2019-3822: Fixed a NTLMv2 type-3 header stack-based buffer overflow (bsc#1123377).

CVE-2019-3823: Fixed an out-of-bounds read in the SMTP end-of-response (bsc#1123378).

CVE-2018-16890: Fixed an out-of-bounds buffer read in NTLM type2 (bsc#1123371).

CVE-2018-16842: Fixed an out-of-bounds read in tool_msgs.c (bsc#1113660).

CVE-2018-16840: Fixed a use-after-free in handle close (bsc#1113029).

CVE-2018-16839: Fixed an SASL password overflow caused by an integer overflow (bsc#1112758).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl fixes the following issues :

  - CVE-2018-16839: A SASL password overflow via integer     overflow was fixed which could lead to crashes     (bsc#1112758)

  - CVE-2018-16840: A use-after-free in SASL handle close     was fixed which could lead to crashes (bsc#1112758)

  - CVE-2018-16842: A Out-of-bounds Read in tool_msgs.c was     fixed which could lead to crashes (bsc#1113660)

This update was imported from the SUSE:SLE-15:Update update project.

New curl packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3805-1 advisory.

    Harry Sintonen discovered that curl incorrectly handled SASL authentication. A remote attacker could use     this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2018-16839)

    Brian Carpenter discovered that curl incorrectly handled memory when closing certain handles. A remote     attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2018-16840)

    Brian Carpenter discovered that the curl command-line tool incorrectly handled error messages. A remote     attacker could possibly use this issue to obtain sensitive information. (CVE-2018-16842)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities:

  - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is     enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary     requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3)     execute arbitrary commands via a redirect to an scp: URL. (CVE-2009-0037)

  - The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl     and other products, always performs credential delegation during GSSAPI authentication, which allows     remote servers to impersonate clients via GSSAPI requests. (CVE-2011-2192)

  - curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a     pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as     demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol. (CVE-2012-0036)

  - Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl     and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in     the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message. (CVE-2013-0249)

  - The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path     domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the     domain of a URL. (CVE-2013-1944)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-2181 advisory.

    - CVE-2016-8615 cookie injection for other servers (https://curl.haxx.se/docs/CVE-2016-8615.html)
    - CVE-2016-8616 case insensitive password comparison (https://curl.haxx.se/docs/CVE-2016-8616.html)
    - CVE-2016-8617 OOB write via unchecked multiplication (https://curl.haxx.se/docs/CVE-2016-8617.html)
    - CVE-2016-8618 double-free in curl_maprintf (https://curl.haxx.se/docs/CVE-2016-8618.html)
    - CVE-2016-8619 double-free in krb5 code (https://curl.haxx.se/docs/CVE-2016-8619.html)
    - CVE-2016-8621 curl_getdate read out of bounds (https://curl.haxx.se/docs/CVE-2016-8621.html)
    - CVE-2016-8622 URL unescape heap overflow via integer truncation     (https://curl.haxx.se/docs/CVE-2016-8622.html)
    - CVE-2016-8623 Use-after-free via shared cookies (https://curl.haxx.se/docs/CVE-2016-8623.html)
    - CVE-2016-8624 invalid URL parsing with # (https://curl.haxx.se/docs/CVE-2016-8624.html)
    - fix NTLM password overflow via integer overflow (CVE-2018-14618)
    - fix bad arithmetic when outputting warnings to stderr (CVE-2018-16842)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - curl: Heap-based buffer over-read in the curl tool     warning formatting (CVE-2018-16842)

An update for curl is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es) :

* curl: Heap-based buffer over-read in the curl tool warning formatting (CVE-2018-16842)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Several vulnerabilities were discovered in cURL, an URL transfer library.

CVE-2016-7141

When built with NSS and the libnsspem.so library is available at runtime, allows an remote attacker to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420.

CVE-2016-7167

Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.

CVE-2016-9586

Curl is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any applications that accept a format string from the outside without necessary input filtering, it could allow remote attacks.

CVE-2018-16839

Curl is vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

CVE-2018-16842

Curl is vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

For Debian 8 'Jessie', these problems have been fixed in version 7.38.0-4+deb8u13.

We recommend that you upgrade your curl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl fixes the following issues :

CVE-2018-16839: A SASL password overflow via integer overflow was fixed which could lead to crashes (bsc#1112758)

CVE-2018-16840: A use-after-free in SASL handle close was fixed which could lead to crashes (bsc#1112758)

CVE-2018-16842: A Out-of-bounds Read in tool_msgs.c was fixed which could lead to crashes (bsc#1113660)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
120934	Fedora 28 : curl (2018-fdc4ca8675)	Nessus	Fedora Local Security Checks	2019/1/3	2024/6/28	critical
122149	SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2019:0339-1)	Nessus	SuSE Local Security Checks	2019/2/13	2024/6/20	critical
123369	openSUSE Security Update : curl (openSUSE-2019-903)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/10	critical
118586	Slackware 14.0 / 14.1 / 14.2 / current : curl (SSA:2018-304-01)	Nessus	Slackware Local Security Checks	2018/11/1	2022/1/31	critical
118591	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : curl vulnerabilities (USN-3805-1)	Nessus	Ubuntu Local Security Checks	2018/11/1	2024/8/27	critical
206854	NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/10	critical
180832	Oracle Linux 7 : curl (ELSA-2019-2181)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/22	critical
128212	Scientific Linux Security Update : curl on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	2019/8/27	2024/5/1	critical
128372	CentOS 7 : curl (CESA-2019:2181)	Nessus	CentOS Local Security Checks	2019/8/30	2019/12/31	critical
118753	Debian DLA-1568-1 : curl security update	Nessus	Debian Local Security Checks	2018/11/7	2024/7/25	critical
120154	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2018:3624-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/10	critical
120542	Fedora 29 : curl (2018-7785911c9e)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/2	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical