English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 143769 CVE descriptions
and 71225 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.704331
Category:Debian Local Security Checks
Title:Debian Security Advisory DSA 4331-1 (curl - security update)
Summary:Two vulnerabilities were discovered in cURL, an URL transfer library.;;CVE-2018-16839 ;Harry Sintonen discovered that, on systems with a 32 bit size_t, an;integer overflow would be triggered when a SASL user name longer;than 2GB is used. This would in turn cause a very small buffer to be;allocated instead of the intended very huge one, which would trigger;a heap buffer overflow when the buffer is used.;;CVE-2018-16842 ;Brian Carpenter discovered that the logic in the curl tool to wrap;error messages at 80 columns is flawed, leading to a read buffer;overflow if a single word in the message is itself longer than 80;bytes.
Description:Summary:
Two vulnerabilities were discovered in cURL, an URL transfer library.

CVE-2018-16839
Harry Sintonen discovered that, on systems with a 32 bit size_t, an
integer overflow would be triggered when a SASL user name longer
than 2GB is used. This would in turn cause a very small buffer to be
allocated instead of the intended very huge one, which would trigger
a heap buffer overflow when the buffer is used.

CVE-2018-16842
Brian Carpenter discovered that the logic in the curl tool to wrap
error messages at 80 columns is flawed, leading to a read buffer
overflow if a single word in the message is itself longer than 80
bytes.

Vulnerability Insight:
curl is a command line tool for transferring data with URL syntax, supporting
DICT, FILE, FTP, FTPS, GOPHER, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, POP3,
POP3S, RTMP, RTSP, SCP, SFTP, SMTP, SMTPS, TELNET and TFTP.

Affected Software/OS:
curl on Debian Linux

Solution:
For the stable distribution (stretch), these problems have been fixed in
version 7.52.1-5+deb9u8.

We recommend that you upgrade your curl packages.

For the detailed security status of curl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/curl

CVSS Score:
7.5

CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2018-16839
Common Vulnerability Exposure (CVE) ID: CVE-2018-16842
CopyrightCopyright (c) 2018 Greenbone Networks GmbH http://greenbone.net

This is only one of 71225 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Developer APIs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe

© 1998-2019 E-Soft Inc. All rights reserved.