Most recent entries from all

bdu:2019-00965

Withdrawn: BELL-CVE-2019-3822 — CVE-2019-3822 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2019-avi-151 — De multiples vulnérabilités ont été découvertes dans les produits Siemens. Elles permettent à un attaquant de provoquer…

certfr-2019-avi-151

Withdrawn: CLEANSTART-2026-AY18527 — Security fixes for CVE-2014-0138, CVE-2014-0139, CVE-2016-5419, CVE-2016-5420, CVE-2016-5421, CVE-2016-7141, CVE-2016-7…

Withdrawn by the publisher.

Affected: CleanStart: curl

Multiple security vulnerabilities affect the curl package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-291522

fkie_cve-2019-3822

libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.

GHSA-8wr2-mqj7-7vxp

gsd-2019-3822

ICSA-19-099-04 — Siemens SINEMA Remote Connect (Update A)

The libcurl library versions 7.15.4 to and including 7.61.0 are vulnerable to a buffer overrun. The flaw is caused by an improper calculation of the required buffer size in the Curl_ntlm_core_mk_nt_hash function of libcurl. The security vulnerability could be exploited by an attacker providing a malicious HTTP server. The libcurl library versions 7.34.0 to and including 7.63.0 are vulnerable to a heap buffer out-of-bounds read. The security vulnerability could be exploited by an attacker providing a malicious HTTP server. The libcurl library versions 7.34.0 to and including 7.63.0 are vulnerable to a stack-based buffer overflow. The security vulnerability could be exploited by an attacker providing a malicious HTTP server. The libcurl library versions 7.34.0 to and including 7.63.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. This vulnerability could allow an attacker to trigger a Denial-of-Service condition on the affected devices. Due to insufficient checking of user permissions, an attacker may access URLs that require special authorization. An attacker must have access to a low privileged account in order to exploit the vulnerability.

openSUSE-SU-2019:0174-1 — Security update for curl

Security update for curl

RHSA-2019:1543 — Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP2 security update

ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client to hang libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c curl: Integer overflow leading to heap-based buffer overflow in Curl_sasl_create_plain_message() curl: Use-after-free when closing "easy" handle in Curl_close() curl: Heap-based buffer over-read in the curl tool warning formatting curl: NTLM type-2 heap out-of-bounds buffer read curl: Out-of-bounds read in code handling HTTP/2 trailers curl: HTTP authentication leak in redirects curl: FTP path trickery leads to NIL byte out of bounds write curl: LDAP NULL pointer dereference curl: RTSP RTP buffer over-read httpd: privilege escalation from modules scripts curl: NTLMv2 type-3 header stack buffer overflow curl: SMTP end-of-response out-of-bounds read curl: TFTP receive heap buffer overflow in tftp_receive_packet() function

SUSE-SU-2019:0248-1 — Security update for curl

Security update for curl

UBUNTU-CVE-2019-3822

Affected: Ubuntu:16.04:LTS: curl, Ubuntu:18.04:LTS: curl

WID-SEC-W-2023-1640 — cURL: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Informationen offenzulegen oder einen Denial of Service Angriff durchzuführen.