High WID-SEC-2023-1652 11 CVEs

cURL: Mehrere Schwachstellen

Published Nov 2, 2016 · Updated Dec 13, 2023 · Revision 22 · de-DE

Vendor: Debian Vendor: Dell Vendor: F5 Vendor: Oracle Vendor: Red Hat Vendor: SUSE Vendor: Ubuntu Product: BIG-IP Product: Enterprise Linux Product: Enterprise Manager Product: Linux Product: Linux Product: Linux Product: Linux Product: NetWorker < 19.9.0.1 Product: Policy Enforcement Manager Product: VM Product: WebAccelerator Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um das System zum Absturz zu bringen, um Informationen aus den Cookies offenzulegen, um dem Benutzer falsche Informationen darzustellen und sich als ein Benutzer auszugeben.

Product

cURL ist eine Client-Software, die das Austauschen von Dateien mittels mehrerer Protokolle wie z. B. HTTP oder FTP erlaubt.

Vulnerabilities 11

Medium 6.5

CVE-2016-8620

The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read v…

The curl Project curl curl curl Debian Ubuntu Alpine

Aug 1, 2018
Medium 5.3

CVE-2016-8615

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back…

The curl Project curl curl curl Debian Ubuntu Alpine

Aug 1, 2018
Medium 5.3

CVE-2016-8618

The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to …

The curl Project curl curl curl Debian Ubuntu Alpine

Jul 31, 2018
Medium 5.3

CVE-2016-8619

The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.

The curl Project curl curl curl Debian Ubuntu Alpine

Aug 1, 2018
Medium 5.3

CVE-2016-8621

The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an inpu…

The curl Project curl curl curl Debian Ubuntu Alpine

Jul 31, 2018
Medium 5.3

CVE-2016-8624

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with…

The curl Project curl curl curl Debian Ubuntu Alpine

Jul 31, 2018
Medium 5.3

CVE-2016-8625

curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead user…

The curl Project curl curl curl Debian Ubuntu Alpine

Aug 1, 2018
Low 3.7

CVE-2016-8616

A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons …

The curl Project curl curl curl Debian Ubuntu Alpine

Aug 1, 2018
Low 3.7

CVE-2016-8622

The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if t…

The curl Project curl curl curl Debian Ubuntu Alpine

Jul 31, 2018
Low 3.3

CVE-2016-8617

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if…

The curl Project curl curl curl Debian Ubuntu Alpine

Jul 31, 2018
Low 3.3

CVE-2016-8623

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-aft…

The curl Project curl curl curl Debian Ubuntu Alpine

Aug 1, 2018

Revision history

2023-12-13 #22
Neue Updates von Oracle Linux aufgenommen
2023-07-04 #21
Neue Updates von Dell aufgenommen
2020-11-11 #20
Neue Updates von Oracle Linux aufgenommen
2020-09-01 #19
Neue Updates von ORACLE aufgenommen
2019-07-30 #18
Neue Updates von Oracle Linux aufgenommen
2019-05-21 #17
Neue Updates von Oracle Linux aufgenommen
2018-11-13 #16
New remediations available
2018-08-16 #15
New remediations available
2018-07-31 #14
New remediations available
2017-12-21 #13
New remediations available
2017-05-01 #12
New remediations available
2017-04-24 #11
New remediations available
2017-04-17 #9
New remediations available
2017-04-17 #10
Version nicht vorhanden
2017-04-12 #7
New remediations available
2017-04-12 #8
Version nicht vorhanden
2016-11-06 #6
New remediations available
2016-11-03 #3
New remediations available
2016-11-03 #4
New remediations available
2016-11-03 #5
Version nicht vorhanden
2016-11-02 #1
Initial Release
2016-11-02 #2
Version nicht vorhanden

References

Meldung auf der oss-sec Mailing Liste vom 2016-11-01
http://marc.info/?l=oss-security&m=147807157209510&w=2
Meldung auf der oss-sec Mailing Liste vom 2016-11-01
http://marc.info/?l=oss-security&m=147807141909472&w=2
Meldung auf der oss-sec Mailing Liste vom 2016-11-01
http://marc.info/?l=oss-security&m=147807130909435&w=2
Meldung auf der oss-sec Mailing Liste vom 2016-11-01
http://marc.info/?l=oss-security&m=147807120209419&w=2
Meldung auf der oss-sec Mailing Liste vom 2016-11-01
http://marc.info/?l=oss-security&m=147807109409386&w=2
Meldung auf der oss-sec Mailing Liste vom 2016-11-01
http://marc.info/?l=oss-security&m=147807098309363&w=2
Meldung auf der oss-sec Mailing Liste vom 2016-11-01
http://marc.info/?l=oss-security&m=147807087409344&w=2
Meldung auf der oss-sec Mailing Liste vom 2016-11-01
http://marc.info/?l=oss-security&m=147807076609326&w=2
Meldung auf der oss-sec Mailing Liste vom 2016-11-01
http://marc.info/?l=oss-security&m=147807065309305&w=2
Meldung auf der oss-sec Mailing Liste vom 2016-11-01
http://marc.info/?l=oss-security&m=147807054209225&w=2
Meldung auf der oss-sec Mailing Liste vom 2016-11-01
http://marc.info/?l=oss-security&m=147807042909205&w=2
SUSE Security Update SUSE-SU-2016:2699-1 vom 2016-11-02
https://www.suse.com/support/update/announcement/2016/suse-su-20162699-1.html
SUSE Security Update SUSE-SU-2016:2714-1 vom 2016-11-04
https://www.suse.com/support/update/announcement/2016/suse-su-20162714-1.html
Ubuntu Security Notice USN-3123-1 vom 2016-11-03
http://www.ubuntu.com/usn/usn-3123-1/
Debian Security Advisory DSA-3705-1 vom 2016-11-03
https://lists.debian.org/debian-security-announce/2016/msg00288.html
SUSE Security Update SUSE-SU-2016:2700-1 vom 2016-11-07
https://www.suse.com/de-de/support/update/announcement/2016/suse-su-20162700-1/
F5 Security Advisory K44503763 vom 2017-04-12
https://support.f5.com/csp/article/K44503763
F5 Security Advisory K52828640 vom 2017-04-12
https://support.f5.com/csp/article/K52828640
F5 Security Advisory K46123931 vom 2017-04-12
https://support.f5.com/csp/article/K46123931
F5 Security Advisory K01006862 vom 2017-04-12
https://support.f5.com/csp/article/K01006862
F5 Security Advisory K23391972 vom 2017-04-14
https://support.f5.com/csp/article/K23391972
F5 Security Advisory K84940705 vom 2017-04-14
https://support.f5.com/csp/article/K84940705
F5 Security Advisory K26899353 vom 2017-04-19
https://support.f5.com/csp/article/K26899353
F5 Security Advisory K10196624 vom 2017-04-21
https://support.f5.com/csp/article/K10196624
F5 Security Advisory K31411450 vom 2017-05-02
https://support.f5.com/csp/article/K31411450
F5 Security Advisory K85235351 vom 2017-12-22
https://support.f5.com/csp/article/K85235351
Juniper Security Bulletin: JSA10874
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10874&actp=RSS
Red Hat Security Advisory RHSA-2018:2486 vom 2018-08-17
https://access.redhat.com/errata/RHSA-2018:2486
Red Hat Security Advisory RHSA-2018:3558 vom 2018-11-14
https://access.redhat.com/errata/RHSA-2018:3558
Oracle Linux Security Advisory ELSA-2019-4652 vom 2019-05-21
http://linux.oracle.com/errata/ELSA-2019-4652.html
Oracle Linux Security Advisory ELSA-2019-1880 vom 2019-07-30
http://linux.oracle.com/errata/ELSA-2019-1880.html
ORACLE OVMSA-2020-0035 vom 2020-09-01
https://oss.oracle.com/pipermail/oraclevm-errata/2020-September/000998.html
Oracle Linux Security Advisory ELSA-2020-5002 vom 2020-11-12
http://linux.oracle.com/errata/ELSA-2020-5002.html
Security update for Dell NetWorker
https://www.dell.com/support/kbdoc/de-de/000215497/dsa-2023-233-security-update-for-dell-networker-curl-7-51-0
Oracle Linux Security Advisory ELSA-2023-7743 vom 2023-12-13
https://linux.oracle.com/errata/ELSA-2023-7743.html