DeutschShown in its original language — a full translation is planned for a future version.
cURL: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen
view advisory published 2017-08-08
Ein lokaler oder entfernter anonymer Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Informationen offenzulegen.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-1000101US | medium6.5 | — | ||
curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function tha… | ||||
| CVE-2017-1000100US | medium6.5 | — | ||
When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer bo… | ||||
| CVE-2017-1000099US | medium6.5 | — | ||
When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this would send the wrong buf… | ||||
02
references
External citations — patches, advisories, analysis.
- Eintrag in der OSS Mailing Liste vom 2017-08-08external
- Ubuntu Security Notice USN-3441-1 vom 2017-10-10external
- Ubuntu Security Notice USN-3441-2 vom 2017-10-24external
- Red Hat Security Advisory RHSA-2018:3558 vom 2018-11-14external
- Curl Security Advisory vom 2017-08-08external
- Curl Security Advisory vom 2017-08-08external
- Curl Security Advisory vom 2017-08-08external
- Juniper Security Bulletin: JSA10874external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan