Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.67166
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2010:0273
Summary:NOSUMMARY
Description:Description:
The remote host is missing updates announced in
advisory RHSA-2010:0273.

cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and DICT
servers, using any of the supported protocols. cURL is designed to work
without user interaction or any kind of interactivity.

Wesley Miaw discovered that when deflate compression was used, libcurl
could call the registered write callback function with data exceeding the
documented limit. A malicious server could use this flaw to crash an
application using libcurl or, potentially, execute arbitrary code. Note:
This issue only affected applications using libcurl that rely on the
documented data size limit, and that copy the data to the insufficiently
sized buffer. (CVE-2010-0734)

Solution:
Users of curl should upgrade to these updated packages, which contain
backported patches to correct these issues and add these enhancements. All
running applications using libcurl must be restarted for the update to take
effect.

Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2010-0273.html
http://www.redhat.com/security/updates/classification/#moderate

Risk factor : High

CVSS Score:
6.8

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2010-0734
http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html
Bugtraq: 20101027 rPSA-2010-0072-1 curl (Google Search)
http://www.securityfocus.com/archive/1/514490/100/0/threaded
Bugtraq: 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX (Google Search)
http://www.securityfocus.com/archive/1/516397/100/0/threaded
Debian Security Information: DSA-2023 (Google Search)
http://www.debian.org/security/2010/dsa-2023
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037143.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036744.html
http://security.gentoo.org/glsa/glsa-201203-02.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2010:062
http://www.openwall.com/lists/oss-security/2010/02/09/5
http://www.openwall.com/lists/oss-security/2010/03/09/1
http://www.openwall.com/lists/oss-security/2010/03/16/11
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10760
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6756
http://www.redhat.com/support/errata/RHSA-2010-0329.html
http://secunia.com/advisories/38843
http://secunia.com/advisories/38981
http://secunia.com/advisories/39087
http://secunia.com/advisories/39734
http://secunia.com/advisories/40220
http://secunia.com/advisories/45047
http://secunia.com/advisories/48256
http://www.ubuntu.com/usn/USN-1158-1
http://www.vupen.com/english/advisories/2010/0571
http://www.vupen.com/english/advisories/2010/0602
http://www.vupen.com/english/advisories/2010/0660
http://www.vupen.com/english/advisories/2010/0725
http://www.vupen.com/english/advisories/2010/1481
CopyrightCopyright (c) 2010 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.