Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities:

  - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is     enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary     requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3)     execute arbitrary commands via a redirect to an scp: URL. (CVE-2009-0037)

  - The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl     and other products, always performs credential delegation during GSSAPI authentication, which allows     remote servers to impersonate clients via GSSAPI requests. (CVE-2011-2192)

  - curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a     pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as     demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol. (CVE-2012-0036)

  - Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl     and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in     the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message. (CVE-2013-0249)

  - The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path     domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the     domain of a URL. (CVE-2013-1944)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - curl: NTLM password overflow via integer overflow (CVE-2018-14618)

  - cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM     connections, which might allow context-dependent attackers to authenticate as other users via a request.
    (CVE-2014-0015)

  - The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3,     (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might     allow context-dependent attackers to connect as other users via a request, a similar issue to     CVE-2014-0015. (CVE-2014-0138)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - curl: NTLM password overflow via integer overflow (CVE-2018-14618)

  - The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy     and destination server, which might allow remote proxy servers to obtain sensitive information by reading     the header contents. (CVE-2015-3153)

  - The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-     authenticated proxy connections, which might allow remote attackers to authenticate as other users via a     request, a similar issue to CVE-2014-0015. (CVE-2016-0755)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - curl: FTP wildcard out of bounds read (CVE-2017-8817)

  - CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows     remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF     sequences in a URL. (CVE-2014-8150)

  - The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy     and destination server, which might allow remote proxy servers to obtain sensitive information by reading     the header contents. (CVE-2015-3153)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3558 advisory.

  - curl: TLS session resumption client cert bypass (CVE-2016-5419)

  - curl: Re-using connection with wrong client cert (CVE-2016-5420)

  - curl: Use of connection struct after free (CVE-2016-5421)

  - curl: Incorrect reuse of client certificates (CVE-2016-7141)

  - curl: escape and unescape integer overflows (CVE-2016-7167)

  - curl: Cookie injection for other servers (CVE-2016-8615)

  - curl: Case insensitive password comparison (CVE-2016-8616)

  - curl: Out-of-bounds write via unchecked multiplication (CVE-2016-8617)

  - curl: Double-free in curl_maprintf (CVE-2016-8618)

  - curl: Double-free in krb5 code (CVE-2016-8619)

  - curl: Glob parser write/read out of bounds (CVE-2016-8620)

  - curl: curl_getdate out-of-bounds read (CVE-2016-8621)

  - curl: URL unescape heap overflow via integer truncation (CVE-2016-8622)

  - curl: Use-after-free via shared cookies (CVE-2016-8623)

  - curl: Invalid URL parsing with '#' (CVE-2016-8624)

  - curl: IDNA 2003 makes curl use wrong host (CVE-2016-8625)

  - curl: printf floating point buffer overflow (CVE-2016-9586)

  - curl: --write-out out of bounds read (CVE-2017-7407)

  - curl: NTLM buffer overflow via integer overflow (CVE-2017-8816)

  - curl: FTP wildcard out of bounds read (CVE-2017-8817)

  - httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values (CVE-2017-15710)

  - httpd: <FilesMatch> bypass with a trailing newline in the file name (CVE-2017-15715)

  - curl: TFTP sends more than buffer size (CVE-2017-1000100)

  - curl: URL globbing out of bounds read (CVE-2017-1000101)

  - curl: FTP PWD response parser out of bounds read (CVE-2017-1000254)

  - curl: IMAP FETCH response out of bounds read (CVE-2017-1000257)

  - httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI     applications (CVE-2018-1283)

  - httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)

  - httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)

  - httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)

  - httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)

  - httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)

  - curl: NTLM password overflow via integer overflow (CVE-2018-14618)

  - curl: HTTP authentication leak in redirects (CVE-2018-1000007)

  - curl: FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)

  - curl: LDAP NULL pointer dereference (CVE-2018-1000121)

  - curl: RTSP RTP buffer over-read (CVE-2018-1000122)

  - curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service     (CVE-2018-1000301)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - curl version curl 7.20.0 to and including curl 7.59.0     contains a CWE-126: Buffer Over-read vulnerability in     denial of service that can result in curl can be     tricked into reading data beyond the end of a heap     based buffer used to store downloaded RTSP     content..(CVE-2018-1000301)

  - It was found that the libcurl library did not check the     client certificate when choosing the TLS connection to     reuse. An attacker could potentially use this flaw to     hijack the authentication of the connection by     leveraging a previously created connection with a     different client certificate.(CVE-2016-5420)

  - It was discovered that libcurl could incorrectly reuse     NTLM-authenticated connections for subsequent     unauthenticated requests to the same host. If an     application using libcurl established an     NTLM-authenticated connection to a server, and sent     subsequent unauthenticated requests to the same server,     the unauthenticated requests could be sent over the     NTLM-authenticated connection, appearing as if they     were sent by the NTLM authenticated     user.(CVE-2015-3143)

  - libcurl may read outside of a heap allocated buffer     when doing FTP. When libcurl connects to an FTP server     and successfully logs in (anonymous or not), it asks     the server for the current directory with the `PWD`     command. The server then responds with a 257 response     containing the path, inside double quotes. The returned     path name is then kept by libcurl for subsequent uses.
    Due to a flaw in the string parser for this directory     name, a directory name passed like this but without a     closing double quote would lead to libcurl not adding a     trailing NUL byte to the buffer holding the name. When     libcurl would then later access the string, it could     read beyond the allocated heap buffer and crash or     wrongly access data beyond the buffer, thinking it was     part of the path. A malicious server could abuse this     fact and effectively prevent libcurl-based clients to     work with it - the PWD command is always issued on new     FTP connections and the mistake has a high chance of     causing a segfault. The simple fact that this has issue     remained undiscovered for this long could suggest that     malformed PWD responses are rare in benign servers. We     are not aware of any exploit of this flaw. This bug was     introduced in commit     415d2e7cb7(https://github.com/curl/curl/commit/415d2e7c     b7), March 2005. In libcurl version 7.56.0, the parser     always zero terminates the string but also rejects it     if not terminated properly with a final double     quote.(CVE-2017-1000254)

  - It was discovered that libcurl could incorrectly reuse     Negotiate authenticated HTTP connections for subsequent     requests. If an application using libcurl established a     Negotiate authenticated HTTP connection to a server and     sent subsequent requests with different credentials,     the connection could be re-used with the initial set of     credentials instead of using the new     ones.(CVE-2015-3148)

  - Heap-based buffer overflow in the curl_easy_unescape     function in lib/escape.c in cURL and libcurl 7.7     through 7.30.0 allows remote attackers to cause a     denial of service (application crash) or possibly     execute arbitrary code via a crafted string ending in a     ''%'' (percent) character.(CVE-2013-2174)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8616)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8619)

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external     entities.(CVE-2018-1000007)

  - A flaw was found in the way the libcurl library     performed the duplication of connection handles. If an     application set the CURLOPT_COPYPOSTFIELDS option for a     handle, using the handle's duplicate could cause the     application to crash or disclose a portion of its     memory.(CVE-2014-3707)

  - Multiple integer overflow flaws leading to heap-based     buffer overflows were found in the way curl handled     escaping and unescaping of data. An attacker could     potentially use these flaws to crash an application     using libcurl by sending a specially crafted input to     the affected libcurl functions.(CVE-2016-7167)

  - When doing a TFTP transfer and curl/libcurl is given a     URL that contains a very long file name (longer than     about 515 bytes), the file name is truncated to fit     within the buffer boundaries, but the buffer size is     still wrongly updated to use the untruncated length.
    This too large value is then used in the sendto() call,     making curl attempt to send more data than what is     actually put into the buffer. The endto() function will     then read beyond the end of the heap based buffer. A     malicious HTTP(S) server could redirect a vulnerable     libcurl-using client to a crafted TFTP URL (if the     client hasn't restricted which protocols it allows     redirects to) and trick it to send private memory     contents to a remote server over UDP. Limit curl's     redirect protocols with --proto-redir and libcurl's     with CURLOPT_REDIR_PROTOCOLS.(CVE-2017-1000100)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in cURL, an URL transfer library.

CVE-2016-7141

When built with NSS and the libnsspem.so library is available at runtime, allows an remote attacker to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420.

CVE-2016-7167

Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.

CVE-2016-9586

Curl is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any applications that accept a format string from the outside without necessary input filtering, it could allow remote attacks.

CVE-2018-16839

Curl is vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

CVE-2018-16842

Curl is vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

For Debian 8 'Jessie', these problems have been fixed in version 7.38.0-4+deb8u13.

We recommend that you upgrade your curl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for curl is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es) :

* Multiple integer overflow flaws leading to heap-based buffer overflows were found in the way curl handled escaping and unescaping of data. An attacker could potentially use these flaws to crash an application using libcurl by sending a specially crafted input to the affected libcurl functions. (CVE-2016-7167)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

Security Fix(es) :

  - Multiple integer overflow flaws leading to heap-based     buffer overflows were found in the way curl handled     escaping and unescaping of data. An attacker could     potentially use these flaws to crash an application     using libcurl by sending a specially crafted input to     the affected libcurl functions. (CVE-2016-7167)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-2016 advisory.

    [7.29.0-42]
    - fix use of uninitialized variable detected by Covscan

    [7.29.0-41]
    - make FTPS work with --proxytunnel (#1420327)

    [7.29.0-40]
    - make FTPS work with --proxytunnel (#1420327)

    [7.29.0-39]
    - work around race condition in PK11_FindSlotByName() in NSS (#1404815)

    [7.29.0-38]
    - make FTPS work with --proxytunnel (#1420327)

    [7.29.0-37]
    - fix tight loop in non-blocking TLS handhsake over proxy (#1388162)
    - handle cookies with numerical IPv6 address (#1341503)
    - make libcurl recognize chacha20-poly1305 and SHA384 cipher-suites (#1374740)
    - curl -E: allow to escape ':' in cert nickname (#1376062)
    - run automake in %prep to avoid patching Makefile.in files from now on

    [7.29.0-36]
    - reject negative string lengths in curl_easy_[un]escape() (CVE-2016-7167)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple integer overflows in the (1) curl_escape, (2)     curl_easy_escape, (3) curl_unescape, and (4)     curl_easy_unescape functions in libcurl before 7.50.3     allow attackers to have unspecified impact via a string     of length 0xffffffff, which triggers a heap-based     buffer overflow.(CVE-2016-7167)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be     provided.(CVE-2016-8615,CVE-2016-8616,CVE-2016-8617,CVE
    -2016-8618,CVE-2016-8619,CVE-2016-8621,CVE-2016-8622,CV     E-2016-8623,CVE-2016-8624)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-47 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers and bug reports referenced for details.
  Impact :

    Remote attackers could conduct a Man-in-the-Middle attack to obtain       sensitive information, cause a Denial of Service condition, or execute       arbitrary code.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of macOS that is 10.12.x prior to 10.12.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - AppleGraphicsPowerManagement
  - Assets
  - Audio
  - Bluetooth
  - CoreCapture
  - CoreFoundation
  - CoreGraphics
  - CoreMedia External Displays
  - CoreMedia Playback
  - CoreStorage
  - CoreText
  - curl
  - Directory Services
  - Disk Images
  - FontParser
  - Foundation
  - Grapher
  - ICU
  - ImageIO
  - Intel Graphics Driver
  - IOFireWireFamily
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - IOSurface
  - Kernel
  - kext tools
  - libarchive
  - LibreSSL
  - OpenLDAP
  - OpenPAM
  - OpenSSL
  - Power Management
  - Security
  - syslog
  - WiFi
  - xar

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Furthermore, CVE-2016-6304, CVE-2016-7596, and CVE-2016-7604 also affect Mac OS X versions 10.10.5 and 10.11.6. However, this plugin does not check those versions.

Versions of cURL and libcurl prior to 7.50.3 are affected by an integer overflow condition in the 'curl_escape()', 'curl_easy_escape()', 'curl_unescape()', and 'curl_easy_unescape()' functions in 'lib/escape.c' that is triggered when handling overly long string lengths. This may allow a context-dependent attacker to cause a heap-based buffer overflow, crashing a process linked against the library or potentially allowing the execution of arbitrary code.

- reject negative string lengths in curl_easy_[un]escape()     (CVE-2016-7167)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl fixes the following security issues :

  - CVE-2016-8624: invalid URL parsing with '#'     (bsc#1005646)

  - CVE-2016-8623: Use-after-free via shared cookies     (bsc#1005645)

  - CVE-2016-8622: URL unescape heap overflow via integer     truncation (bsc#1005643)

  - CVE-2016-8621: curl_getdate read out of bounds     (bsc#1005642)

  - CVE-2016-8620: glob parser write/read out of bounds     (bsc#1005640)

  - CVE-2016-8619: double-free in krb5 code (bsc#1005638)

  - CVE-2016-8618: double-free in curl_maprintf     (bsc#1005637)

  - CVE-2016-8617: OOB write via unchecked multiplication     (bsc#1005635)

  - CVE-2016-8616: case insensitive password comparison     (bsc#1005634)

  - CVE-2016-8615: cookie injection for other servers     (bsc#1005633)

  - CVE-2016-7167: escape and unescape integer overflows     (bsc#998760)

This update was imported from the SUSE:SLE-12:Update update project.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3123-1 advisory.

    It was discovered that curl incorrectly reused client certificates when built with NSS. A remote attacker     could possibly use this issue to hijack the authentication of a TLS connection. (CVE-2016-7141)

    Nguyen Vu Hoang discovered that curl incorrectly handled escaping certain strings. A remote attacker could     possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-7167)

    It was discovered that curl incorrectly handled storing cookies. A remote attacker could possibly use this     issue to inject cookies for arbitrary domains in the cookie jar. (CVE-2016-8615)

    It was discovered that curl incorrect handled case when comparing user names and passwords. A remote     attacker with knowledge of a case-insensitive version of the correct password could possibly use this     issue to cause a connection to be reused. (CVE-2016-8616)

    It was discovered that curl incorrect handled memory when encoding to base64. A remote attacker could     possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-8617)

    It was discovered that curl incorrect handled memory when preparing formatted output. A remote attacker     could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2016-8618)

    It was discovered that curl incorrect handled memory when performing Kerberos authentication. A remote     attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2016-8619)

    Lut Nguyn discovered that curl incorrectly handled parsing globs. A remote attacker could possibly     use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-8620)

    Lut Nguyn discovered that curl incorrectly handled converting dates. A remote attacker could     possibly use this issue to cause curl to crash, resulting in a denial of service. (CVE-2016-8621)

    It was discovered that curl incorrectly handled URL percent-encoding decoding. A remote attacker could     possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-8622)

    It was discovered that curl incorrectly handled shared cookies. A remote server could possibly obtain     incorrect cookies or other sensitive information. (CVE-2016-8623)

    Fernando Muoz discovered that curl incorrect parsed certain URLs. A remote attacker could possibly use     this issue to trick curl into connecting to a different host. (CVE-2016-8624)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for curl fixes the following security issues :

  - CVE-2016-8624: invalid URL parsing with '#'     (bsc#1005646)

  - CVE-2016-8623: Use-after-free via shared cookies     (bsc#1005645)

  - CVE-2016-8621: curl_getdate read out of bounds     (bsc#1005642)

  - CVE-2016-8619: double-free in krb5 code (bsc#1005638)

  - CVE-2016-8618: double-free in curl_maprintf     (bsc#1005637)

  - CVE-2016-8617: OOB write via unchecked multiplication     (bsc#1005635)

  - CVE-2016-8616: case insensitive password comparison     (bsc#1005634)

  - CVE-2016-8615: cookie injection for other servers     (bsc#1005633)

  - CVE-2016-7167: escape and unescape integer overflows     (bsc#998760)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl fixes the following security issues :

  - CVE-2016-8624: invalid URL parsing with '#'     (bsc#1005646)

  - CVE-2016-8623: Use-after-free via shared cookies     (bsc#1005645)

  - CVE-2016-8622: URL unescape heap overflow via integer     truncation (bsc#1005643)

  - CVE-2016-8621: curl_getdate read out of bounds     (bsc#1005642)

  - CVE-2016-8620: glob parser write/read out of bounds     (bsc#1005640)

  - CVE-2016-8619: double-free in krb5 code (bsc#1005638)

  - CVE-2016-8618: double-free in curl_maprintf     (bsc#1005637)

  - CVE-2016-8617: OOB write via unchecked multiplication     (bsc#1005635)

  - CVE-2016-8616: case insensitive password comparison     (bsc#1005634)

  - CVE-2016-8615: cookie injection for other servers     (bsc#1005633)

  - CVE-2016-7167: escape and unescape integer overflows     (bsc#998760)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

After testing original CVE-2016-5420 patch, it was discovered that libcurl built on top of NSS (Network Security Services) still incorrectly re-uses client certificates if a certificate from file is used for one TLS connection but no certificate is set for a subsequent TLS connection.

It was discovered that the four four libcurl functions curl_escape(), curl_easy_escape(), curl_unescape and curl_easy_unescape accepted negative sting length inputs.

For Debian 7 'Wheezy', these problems have been fixed in version 7.26.0-1+wheezy16.

We recommend that you upgrade your curl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue.

The cURL project reports

The four libcurl functions curl_escape(), curl_easy_escape(), curl_unescape and curl_easy_unescape perform string URL percent escaping and unescaping. They accept custom string length inputs in signed integer arguments.

The provided string length arguments were not properly checked and due to arithmetic in the functions, passing in the length 0xffffffff (2^32-1 or UINT_MAX or even just -1) would end up causing an allocation of zero bytes of heap memory that curl would attempt to write gigabytes of data into.

ID	Name	Product	Family	Severity
206854	NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)	Nessus	NewStart CGSL Local Security Checks	critical
198477	RHEL 5 : curl (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198460	RHEL 6 : curl (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198450	RHEL 7 : curl (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
194113	RHEL 6 / 7 : httpd24 (RHSA-2018:3558)	Nessus	Red Hat Local Security Checks	critical
125003	EulerOS Virtualization 3.0.1.0 : curl (EulerOS-SA-2019-1550)	Nessus	Huawei Local Security Checks	critical
118753	Debian DLA-1568-1 : curl security update	Nessus	Debian Local Security Checks	critical
102750	CentOS 7 : curl (CESA-2017:2016)	Nessus	CentOS Local Security Checks	critical
102639	Scientific Linux Security Update : curl on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	critical
102295	Oracle Linux 7 : curl (ELSA-2017-2016)	Nessus	Oracle Linux Local Security Checks	critical
102111	RHEL 7 : curl (RHSA-2017:2016)	Nessus	Red Hat Local Security Checks	critical
99881	EulerOS 2.0 SP1 : curl (EulerOS-SA-2017-1036)	Nessus	Huawei Local Security Checks	critical
99880	EulerOS 2.0 SP2 : curl (EulerOS-SA-2017-1035)	Nessus	Huawei Local Security Checks	critical
96644	GLSA-201701-47 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
95917	macOS 10.12.x < 10.12.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
9825	cURL/libcurl 7.x < 7.50.3 RCE	Nessus Network Monitor	Web Clients	high
94770	Fedora 25 : curl (2016-08533fc59c)	Nessus	Fedora Local Security Checks	critical
94752	openSUSE Security Update : curl (openSUSE-2016-1280)	Nessus	SuSE Local Security Checks	critical
94574	Ubuntu 14.04 LTS / 16.04 LTS : curl vulnerabilities (USN-3123-1)	Nessus	Ubuntu Local Security Checks	critical
94572	SUSE SLES11 Security Update : curl (SUSE-SU-2016:2714-1)	Nessus	SuSE Local Security Checks	critical
94506	SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2016:2699-1)	Nessus	SuSE Local Security Checks	critical
93883	Fedora 23 : curl (2016-80f4f71eff)	Nessus	Fedora Local Security Checks	critical
93743	Amazon Linux AMI : curl (ALAS-2016-742)	Nessus	Amazon Linux Local Security Checks	critical
93565	Debian DLA-625-1 : curl security update	Nessus	Debian Local Security Checks	critical
93551	Fedora 24 : curl (2016-7a2ed52d41)	Nessus	Fedora Local Security Checks	critical
93535	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : curl (SSA:2016-259-01)	Nessus	Slackware Local Security Checks	critical
93498	FreeBSD : cURL -- Escape and unescape integer overflows (b018121b-7a4b-11e6-bf52-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2016-7167

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical