DeutschShown in its original language — a full translation is planned for a future version.
cURL: Mehrere Schwachstellen
view advisory published 2016-11-02
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um das System zum Absturz zu bringen, um Informationen aus den Cookies offenzulegen, um dem Benutzer falsche Informationen darzustellen und sich als ein Benutzer auszugeben.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-8625US | high7.5 | — | ||
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer reque… | ||||
| CVE-2016-8623US | high7.5 | — | ||
A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure. | ||||
| CVE-2016-8620US | critical9.8 | — | ||
The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input. | ||||
| CVE-2016-8619US | critical9.8 | — | ||
The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free. | ||||
| CVE-2016-8616US | medium5.9 | — | ||
A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This… | ||||
| CVE-2016-8615US | high7.5 | — | ||
A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server ca… | ||||
| CVE-2016-8621US | high7.5 | — | ||
The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short. | ||||
| CVE-2016-8617US | high7.0 | — | ||
The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`. | ||||
| CVE-2016-8624US | high7.5 | — | ||
curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connectin… | ||||
| CVE-2016-8622US | critical9.8 | — | ||
The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination… | ||||
| CVE-2016-8618US | critical9.8 | — | ||
The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `s… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2019-1880 vom 2019-07-30external
- Oracle Linux Security Advisory ELSA-2019-4652 vom 2019-05-21external
- Oracle Linux Security Advisory ELSA-2020-5002 vom 2020-11-12external
- Meldung auf der oss-sec Mailing Liste vom 2016-11-01external
- Meldung auf der oss-sec Mailing Liste vom 2016-11-01external
- Meldung auf der oss-sec Mailing Liste vom 2016-11-01external
- Meldung auf der oss-sec Mailing Liste vom 2016-11-01external
- Meldung auf der oss-sec Mailing Liste vom 2016-11-01external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan