CVSS: 7.8EPSS: 0%CPEs: 14EXPL: 0CVE-2019-5443
https://notcve.org/view.php?id=CVE-2019-5443
A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants. Un usuario o programa no privilegiado puede colocar un código y un archivo de configuración en una ruta (path) no privilegiada conocida (bajo C:/usr/local/) que hará que curl anterior a versión 7.65.1 incluyéndola, ejecute automáticamente el código en la invocación (como un "engine" openssl). Si ese curl es invocado por un usuario privilegiado, este puede hacer lo que desee. • http://www.openwall.com/lists/oss-security/2019/06/24/1 http://www.securityfocus.com/bid/108881 https://curl.haxx.se/docs/CVE-2019-5443.html https://security.netapp.com/advisory/ntap-20191017-0002 https://www.oracle.com/security-alerts/cpuapr2020.html https://www.oracle.com/security-alerts/cpuoct2020.html https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-427: Uncontrolled Search Path Element •
CVSS: 7.8EPSS: 5%CPEs: 16EXPL: 1CVE-2019-5436 – curl: TFTP receive heap buffer overflow in tftp_receive_packet() function
https://notcve.org/view.php?id=CVE-2019-5436
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. Un desbordamiento de búfer en la memoria dinámica (heap) del código de recepción TFTP, permite la ejecución de código arbitrario o una Denegación de Servicio (DoS) en las versiones de libcurl 7.19.4 hasta 7.64.1. • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html http://www.openwall.com/lists/oss-security/2019/09/11/6 https://curl.haxx.se/docs/CVE-2019-5436.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2 https://seclists.org/bugtraq/2020/Feb/36 https://security.gentoo.org/glsa/202003-29 https://security.netapp.com/advisory& • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 19%CPEs: 23EXPL: 1CVE-2019-3822 – curl: NTLMv2 type-3 header stack buffer overflow
https://notcve.org/view.php?id=CVE-2019-3822
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. • http://www.securityfocus.com/bid/106950 https://access.redhat.com/errata/RHSA-2019:3701 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822 https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf https://curl.haxx.se/docs/CVE-2019-3822.html https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E https://security.gentoo.org/glsa/201903-03 https://security.netapp.com/advisory/ntap-20190315-0001 https://security.n • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.1EPSS: 2%CPEs: 10EXPL: 1CVE-2007-5969 – mysql: possible system table information overwrite using symlinks
https://notcve.org/view.php?id=CVE-2007-5969
MySQL Community Server 5.0.x before 5.0.51, Enterprise Server 5.0.x before 5.0.52, Server 5.1.x before 5.1.23, and Server 6.0.x before 6.0.4, when a table relies on symlinks created through explicit DATA DIRECTORY and INDEX DIRECTORY options, allows remote authenticated users to overwrite system table information and gain privileges via a RENAME TABLE statement that changes the symlink to point to an existing file. MySQL Community Server versiones 5.0.x anteriores a 5.0.51, Enterprise Server versiones 5.0.x anteriores a 5.0.52, Server versiones 5.1.x anteriores a 5.1.23 y Server versiones 6.0.x anteriores a 6.0.4, cuando una tabla se basa en symlinks creados por medio de las opciones explícitas DATA DIRECTORY e INDEX DIRECTORY, permite a los usuarios remotos autenticados sobrescribir la información de la tabla del sistema y alcanzar privilegios por medio de una sentencia RENAME TABLE que cambia el symlink para que apunte hacia un archivo existente. • http://bugs.mysql.com/32111 http://dev.mysql.com/doc/refman/4.1/en/news-4-1-24.html http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0-51.html http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-52.html http://forums.mysql.com/read.php?3%2C186931%2C186931 http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html http://lists.mysql.com/announce/495 http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.htm • CWE-264: Permissions, Privileges, and Access Controls •