CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2017-8818 – Gentoo Linux Security Advisory 201712-04
https://notcve.org/view.php?id=CVE-2017-8818
29 Nov 2017 — curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library. curl y libcurl en versiones anteriores a la 7.57.0 en plataformas de 32 bits permiten que los atacantes provoquen una denegación de servicio (acceso fuera de límites y cierre inesperado de la aplicación) o, posiblemente, provoquen otro impacto porque se a... • http://security.cucumberlinux.com/security/details.php?id=163 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 5%CPEs: 4EXPL: 0CVE-2017-8816 – curl: NTLM buffer overflow via integer overflow
https://notcve.org/view.php?id=CVE-2017-8816
29 Nov 2017 — The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields. La característica de autenticación NTLM en curl y libcurl en versiones anteriores a la 7.57.0 en plataformas de 32-bits permite que los atacantes provoquen una denegación de servicio (desbordamiento de enteros y d... • http://security.cucumberlinux.com/security/details.php?id=161 • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 3%CPEs: 4EXPL: 0CVE-2017-8817 – curl: FTP wildcard out of bounds read
https://notcve.org/view.php?id=CVE-2017-8817
29 Nov 2017 — The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character. La función FTP wildcard en curl y libcurl en versiones anteriores a la 7.57.0 permite que atacantes remotos provoquen una denegación de servicio (lectura fuera de límites y cierre inesperado de aplicación) o, probablemente, causen cualquier otro tipo de impacto median... • http://security.cucumberlinux.com/security/details.php?id=162 • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 32EXPL: 0CVE-2017-1000101 – curl: URL globbing out of bounds read
https://notcve.org/view.php?id=CVE-2017-1000101
09 Aug 2017 — curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would... • http://www.debian.org/security/2017/dsa-3992 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-9502
https://notcve.org/view.php?id=CVE-2017-9502
14 Jun 2017 — In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use when given a URL without a scheme part, had a flaw that could lead to it overwriting a heap based memory buffer with seven bytes. If the default protocol is specified to be FILE or a file: URL lacks two slashes, the given "URL" starts with a drive letter, and libcurl is built for Windows or DOS, then libcurl would copy the path 7 byt... • http://openwall.com/lists/oss-security/2017/06/14/1 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 2.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7407 – curl: --write-out out of bounds read
https://notcve.org/view.php?id=CVE-2017-7407
03 Apr 2017 — The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read. La función ourWriteOut en tool_writeout.c en curl 7.53.1 podría permitir que los atacantes físicamente próximos obtengan información sensible de la memoria del proceso en circunstancias... • http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-2629 – Apple Security Advisory 2017-07-19-2
https://notcve.org/view.php?id=CVE-2017-2629
28 Mar 2017 — curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This ... • http://www.securityfocus.com/bid/96382 • CWE-295: Improper Certificate Validation •
CVSS: 8.1EPSS: 1%CPEs: 1EXPL: 0CVE-2016-9586 – curl: printf floating point buffer overflow
https://notcve.org/view.php?id=CVE-2016-9586
20 Jan 2017 — curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks. curl, en versiones anteriores a la 7.52.0, es vulnerable a un desbordamiento de búfer cuando se realiza un envío de un gran puntero flotante en la implementación de libcurl de la función printf(). Si hay aplicacio... • http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9594 – Gentoo Linux Security Advisory 201701-47
https://notcve.org/view.php?id=CVE-2016-9594
20 Jan 2017 — curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable. curl, en versiones anteriores a la 7.52.1, es vulnerable a un valor aleatorio no inicializado en la función interna de libcurl que devuelve un valor aleatorio bueno de 32 bits. Tener un valor aleatorio débil o virtualmente inexistente hace que las operaciones que lo usan sea... • http://www.securityfocus.com/bid/95094 • CWE-665: Improper Initialization •