rpm package
suse/curl&distro=SUSE Linux Enterprise Server 12 SP1-LTSS
pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS
Vulnerabilities (7)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-5482 | Cri | 9.8 | < 7.37.0-37.43.1 | 7.37.0-37.43.1 | Sep 16, 2019 | Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. | |
| CVE-2019-5436 | Hig | 7.8 | < 7.37.0-37.40.1 | 7.37.0-37.40.1 | May 28, 2019 | A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. | |
| CVE-2019-3823 | — | < 7.37.0-37.34.1 | 7.37.0-37.34.1 | Feb 6, 2019 | libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, | ||
| CVE-2019-3822 | — | < 7.37.0-37.34.1 | 7.37.0-37.34.1 | Feb 6, 2019 | libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received | ||
| CVE-2018-16890 | — | < 7.37.0-37.34.1 | 7.37.0-37.34.1 | Feb 6, 2019 | libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulne | ||
| CVE-2018-16839 | — | < 7.37.0-37.37.1 | 7.37.0-37.37.1 | Oct 31, 2018 | Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service. | ||
| CVE-2018-1000301 | Cri | 9.1 | < 7.37.0-37.23.1 | 7.37.0-37.23.1 | May 24, 2018 | curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability |
- affected < 7.37.0-37.43.1fixed 7.37.0-37.43.1
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
- affected < 7.37.0-37.40.1fixed 7.37.0-37.40.1
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
- CVE-2019-3823Feb 6, 2019affected < 7.37.0-37.34.1fixed 7.37.0-37.34.1
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5,
- CVE-2019-3822Feb 6, 2019affected < 7.37.0-37.34.1fixed 7.37.0-37.34.1
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received
- CVE-2018-16890Feb 6, 2019affected < 7.37.0-37.34.1fixed 7.37.0-37.34.1
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulne
- CVE-2018-16839Oct 31, 2018affected < 7.37.0-37.37.1fixed 7.37.0-37.37.1
Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.
- affected < 7.37.0-37.23.1fixed 7.37.0-37.23.1
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability