Withdrawn by the publisher.

Withdrawn by the publisher.

Affected: CleanStart: curl

Multiple security vulnerabilities affect the curl package. These issues are resolved in later releases. See references for individual vulnerability details.

libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.

libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.

The libcurl library versions 7.15.4 to and including 7.61.0 are vulnerable to a buffer overrun. The flaw is caused by an improper calculation of the required buffer size in the Curl_ntlm_core_mk_nt_hash function of libcurl. The security vulnerability could be exploited by an attacker providing a malicious HTTP server. The libcurl library versions 7.34.0 to and including 7.63.0 are vulnerable to a heap buffer out-of-bounds read. The security vulnerability could be exploited by an attacker providing a malicious HTTP server. The libcurl library versions 7.34.0 to and including 7.63.0 are vulnerable to a stack-based buffer overflow. The security vulnerability could be exploited by an attacker providing a malicious HTTP server. The libcurl library versions 7.34.0 to and including 7.63.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. This vulnerability could allow an attacker to trigger a Denial-of-Service condition on the affected devices. Due to insufficient checking of user permissions, an attacker may access URLs that require special authorization. An attacker must have access to a low privileged account in order to exploit the vulnerability.

Security update for curl

ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client to hang libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c curl: Integer overflow leading to heap-based buffer overflow in Curl_sasl_create_plain_message() curl: Use-after-free when closing "easy" handle in Curl_close() curl: Heap-based buffer over-read in the curl tool warning formatting curl: NTLM type-2 heap out-of-bounds buffer read curl: Out-of-bounds read in code handling HTTP/2 trailers curl: HTTP authentication leak in redirects curl: FTP path trickery leads to NIL byte out of bounds write curl: LDAP NULL pointer dereference curl: RTSP RTP buffer over-read httpd: privilege escalation from modules scripts curl: NTLMv2 type-3 header stack buffer overflow curl: SMTP end-of-response out-of-bounds read curl: TFTP receive heap buffer overflow in tftp_receive_packet() function

Security update for curl

Affected: Ubuntu:16.04:LTS: curl, Ubuntu:18.04:LTS: curl

libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Informationen offenzulegen oder einen Denial of Service Angriff durchzuführen.