Debian Curl vulnerabilities

CVE-2023-38545 [CRITICAL] CVE-2023-38545: curl - This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.... This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and

CVE-2013-0249 [HIGH] CVE-2013-0249: curl - Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function ... Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.

CVE-2011-3389 [MEDIUM] CVE-2011-3389: asterisk - The SSL protocol, as used in certain configurations in Microsoft Windows and Mic... The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS s

CVE-2024-2398 [HIGH] CVE-2024-2398: curl - When an application tells libcurl it wants to allow HTTP/2 server push, and the ... When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefo

CVE-2023-38039 [HIGH] CVE-2023-38039: curl - When curl retrieves an HTTP response, it stores the incoming headers so that the... When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory. Scope: local bookwo

CVE-2019-5436 [HIGH] CVE-2019-5436: curl - A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary co... A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. Scope: local bookworm: resolved (fixed in 7.64.0-4) bullseye: resolved (fixed in 7.64.0-4) forky: resolved (fixed in 7.64.0-4) sid: resolved (fixed in 7.64.0-4) trixie: resolved (fixed in 7.64.0-4)

CVE-2019-3822 [CRITICAL] CVE-2019-3822: curl - libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based bu... libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implem

CVE-2009-0037 [MEDIUM] CVE-2009-0037: curl - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOP... The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.

CVE-2019-5482 [CRITICAL] CVE-2019-5482: curl - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. Scope: local bookworm: resolved (fixed in 7.66.0-1) bullseye: resolved (fixed in 7.66.0-1) forky: resolved (fixed in 7.66.0-1) sid: resolved (fixed in 7.66.0-1) trixie: resolved (fixed in 7.66.0-1)

CVE-2018-14618 [CRITICAL] CVE-2018-14618: curl - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authent... curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the

CVE-2022-32221 [CRITICAL] CVE-2022-32221: curl - When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`... When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wron

CVE-2018-1000120 [CRITICAL] CVE-2018-1000120: curl - A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP ... A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse. Scope: local bookworm: resolved (fixed in 7.60.0-1) bullseye: resolved (fixed in 7.60.0-1) forky: resolved (fixed in 7.60.0-1) sid: resolved (fixed in 7.60.0-1) trixie: resolved (fixed in 7.60.0-1)

CVE-2023-27534 [HIGH] CVE-2023-27534: curl - A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes ... A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by cra

CVE-2022-43551 [HIGH] CVE-2022-43551: curl - A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to tric... A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get re

CVE-2018-1000007 [CRITICAL] CVE-2018-1000007: curl - libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third ... libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response heade

CVE-2021-22945 [CRITICAL] CVE-2021-22945: curl - When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some ... When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*. Scope: local bookworm: resolved (fixed in 7.79.1-1) bullseye: resolved (fixed in 7.74.0-1.3+deb11u2) forky: resolved (fixed in 7.7

CVE-2016-5419 [HIGH] CVE-2016-5419: curl - curl and libcurl before 7.50.1 do not prevent TLS session resumption when the cl... curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session. Scope: local bookworm: resolved (fixed in 7.50.1-1) bullseye: resolved (fixed in 7.50.1-1) forky: resolved (fixed in 7.50.1-1) sid: resolved (fixed in 7.50.1-1) trixie: resolved

CVE-2022-32207 [CRITICAL] CVE-2022-32207: curl - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes... When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended. Scope: local

CVE-2018-0500 [CRITICAL] CVE-2018-0500: curl - Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 h... Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value). Scope: local bookworm: resolved (fixed in 7.61.0-1) bullsey

CVE-2015-3145 [HIGH] CVE-2015-3145: curl - The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does... The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character. Scope: local bookworm: resolved (fixed in 7.42.0-1) bullseye: reso