rpm package
suse/curl&distro=SUSE Linux Enterprise Module for Basesystem 15
pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015
Vulnerabilities (11)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-5482 | Cri | 9.8 | < 7.60.0-3.23.1 | 7.60.0-3.23.1 | Sep 16, 2019 | Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. | |
| CVE-2019-5481 | Cri | 9.8 | < 7.60.0-3.23.1 | 7.60.0-3.23.1 | Sep 16, 2019 | Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. | |
| CVE-2019-5436 | Hig | 7.8 | < 7.60.0-3.20.1 | 7.60.0-3.20.1 | May 28, 2019 | A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. | |
| CVE-2019-3823 | — | < 7.60.0-3.17.1 | 7.60.0-3.17.1 | Feb 6, 2019 | libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, | ||
| CVE-2019-3822 | — | < 7.60.0-3.17.1 | 7.60.0-3.17.1 | Feb 6, 2019 | libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received | ||
| CVE-2018-16890 | — | < 7.60.0-3.17.1 | 7.60.0-3.17.1 | Feb 6, 2019 | libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulne | ||
| CVE-2018-16842 | — | < 7.60.0-3.14.3 | 7.60.0-3.14.3 | Oct 31, 2018 | Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service. | ||
| CVE-2018-16840 | — | < 7.60.0-3.14.3 | 7.60.0-3.14.3 | Oct 31, 2018 | A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and mi | ||
| CVE-2018-16839 | — | < 7.60.0-3.14.3 | 7.60.0-3.14.3 | Oct 31, 2018 | Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service. | ||
| CVE-2018-14618 | — | < 7.60.0-3.9.1 | 7.60.0-3.9.1 | Sep 5, 2018 | curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length va | ||
| CVE-2018-0500 | — | < 7.60.0-3.6.4 | 7.60.0-3.6.4 | Jul 11, 2018 | Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument |
- affected < 7.60.0-3.23.1fixed 7.60.0-3.23.1
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
- affected < 7.60.0-3.23.1fixed 7.60.0-3.23.1
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
- affected < 7.60.0-3.20.1fixed 7.60.0-3.20.1
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
- CVE-2019-3823Feb 6, 2019affected < 7.60.0-3.17.1fixed 7.60.0-3.17.1
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5,
- CVE-2019-3822Feb 6, 2019affected < 7.60.0-3.17.1fixed 7.60.0-3.17.1
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received
- CVE-2018-16890Feb 6, 2019affected < 7.60.0-3.17.1fixed 7.60.0-3.17.1
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulne
- CVE-2018-16842Oct 31, 2018affected < 7.60.0-3.14.3fixed 7.60.0-3.14.3
Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.
- CVE-2018-16840Oct 31, 2018affected < 7.60.0-3.14.3fixed 7.60.0-3.14.3
A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and mi
- CVE-2018-16839Oct 31, 2018affected < 7.60.0-3.14.3fixed 7.60.0-3.14.3
Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.
- CVE-2018-14618Sep 5, 2018affected < 7.60.0-3.9.1fixed 7.60.0-3.9.1
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length va
- CVE-2018-0500Jul 11, 2018affected < 7.60.0-3.6.4fixed 7.60.0-3.6.4
Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument