rpm package
opensuse/curl&distro=openSUSE Leap 15.0
pkg:rpm/opensuse/curl&distro=openSUSE%20Leap%2015.0
Vulnerabilities (6)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-5482 | Cri | 9.8 | < 7.60.0-lp150.2.25.1 | 7.60.0-lp150.2.25.1 | Sep 16, 2019 | Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. | |
| CVE-2019-5481 | Cri | 9.8 | < 7.60.0-lp150.2.25.1 | 7.60.0-lp150.2.25.1 | Sep 16, 2019 | Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. | |
| CVE-2019-5436 | Hig | 7.8 | < 7.60.0-lp151.5.3.1 | 7.60.0-lp151.5.3.1 | May 28, 2019 | A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. | |
| CVE-2019-3823 | — | < 7.60.0-lp150.2.18.1 | 7.60.0-lp150.2.18.1 | Feb 6, 2019 | libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, | ||
| CVE-2019-3822 | — | < 7.60.0-lp150.2.18.1 | 7.60.0-lp150.2.18.1 | Feb 6, 2019 | libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received | ||
| CVE-2018-16890 | — | < 7.60.0-lp150.2.18.1 | 7.60.0-lp150.2.18.1 | Feb 6, 2019 | libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulne |
- affected < 7.60.0-lp150.2.25.1fixed 7.60.0-lp150.2.25.1
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
- affected < 7.60.0-lp150.2.25.1fixed 7.60.0-lp150.2.25.1
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
- affected < 7.60.0-lp151.5.3.1fixed 7.60.0-lp151.5.3.1
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
- CVE-2019-3823Feb 6, 2019affected < 7.60.0-lp150.2.18.1fixed 7.60.0-lp150.2.18.1
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5,
- CVE-2019-3822Feb 6, 2019affected < 7.60.0-lp150.2.18.1fixed 7.60.0-lp150.2.18.1
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received
- CVE-2018-16890Feb 6, 2019affected < 7.60.0-lp150.2.18.1fixed 7.60.0-lp150.2.18.1
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulne