The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3441-1 advisory.

    Daniel Stenberg discovered that curl incorrectly handled large floating point output. A remote attacker     could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-9586)

    Even Rouault discovered that curl incorrectly handled large file names when doing TFTP transfers. A remote     attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly obtain     sensitive memory contents. (CVE-2017-1000100)

    Brian Carpenter and Yongji Ouyang discovered that curl incorrectly handled numerical range globbing. A     remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly     obtain sensitive memory contents. (CVE-2017-1000101)

    Max Dymond discovered that curl incorrectly handled FTP PWD responses. A remote attacker could use this     issue to cause curl to crash, resulting in a denial of service. (CVE-2017-1000254)

    Brian Carpenter discovered that curl incorrectly handled the --write-out command line option. A local     attacker could possibly use this issue to obtain sensitive memory contents. (CVE-2017-7407)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS / 16.04 LTS : curl vulnerabilities (USN-3441-1)

critical Nessus Plugin ID 103773

Version 3.15

Version 3.13

Version 3.15 Feb 18, 2025, 11:54 PM Plugin metadata (CVSS 3 Change AC:H --> AC:L where needed) Plugin Feed: 202502182354
Version 3.13 Oct 21, 2023, 3:09 AM CVSSv2 score source (set to "CVE-2016-9586") Detection Exploit attributes ("Exploit available" set to "False") Plugin metadata Plugin Feed: 202310210309