7.5 - GLSA-201401-14

Executive Summary

Summary
Title	cURL: Multiple vulnerabilities

Informations
Name	GLSA-201401-14	First vendor Publication	2014-01-20
Vendor	Gentoo	Last vendor Modification	2014-01-20
Severity (Vendor)	Normal	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

Multiple vulnerabilities have been found in cURL, allowing attackers to execute arbitrary code or cause Denial of Service.

Background

cURL is a command line tool for transferring files with URL syntax, supporting numerous protocols.

Description

Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could entice a user or automated process to connect to a malicious server using cURL, possibly resulting in the remote execution of arbitrary code or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All cURL users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/curl-7.34.0-r1"

References

[ 1 ] CVE-2013-0249 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0249
[ 2 ] CVE-2013-1944 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1944
[ 3 ] CVE-2013-2174 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2174
[ 4 ] CVE-2013-6422 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6422

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201401-14.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-201401-14.xml

CWE : Common Weakness Enumeration

%	Id	Name
50 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer
25 %	CWE-200	Information Exposure
25 %	CWE-20	Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:18190

Oval ID:	oval:org.mitre.oval:def:18190
Title:	USN-1721-1 -- curl vulnerability
Description:	curl could be made to crash or run programs if it opened a malicious URL. Software Description: - curl: HTTP, HTTPS, and FTP client and client libraries Details: It was discovered that curl incorrectly handled SASL authentication when communicating over POP3, SMTP or IMAP.
Family:	unix	Class:	patch
Reference(s):	USN-1721-1 CVE-2013-0249	Version:	7
Platform(s):	Ubuntu 12.10	Product(s):	curl
Definition Synopsis:
Ubuntu 12.10 is installed Packages match section libcurl3 DPKG is earlier than 7.27.0-1ubuntu1.1 AND libcurl3-gnutls DPKG is earlier than 7.27.0-1ubuntu1.1 AND libcurl3-nss DPKG is earlier than 7.27.0-1ubuntu1.1

Definition Id: oval:org.mitre.oval:def:18259

Oval ID:	oval:org.mitre.oval:def:18259
Title:	USN-1801-1 -- curl vulnerability
Description:	Applications using libcurl could be made to expose sensitive information over the network.
Family:	unix	Class:	patch
Reference(s):	USN-1801-1 CVE-2013-1944	Version:	7
Platform(s):	Ubuntu 12.10 Ubuntu 12.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 8.04	Product(s):	curl
Definition Synopsis:
Release section Ubuntu 12.10 is installed Packages match section curl DPKG is earlier than 7.27.0-1ubuntu1.2 AND libcurl3 DPKG is earlier than 7.27.0-1ubuntu1.2 AND Release section Ubuntu 12.04 is installed Packages match section curl DPKG is earlier than 7.22.0-3ubuntu4.1 AND libcurl3 DPKG is earlier than 7.22.0-3ubuntu4.1 AND Release section Ubuntu 11.10 is installed Packages match section curl DPKG is earlier than 7.21.6-3ubuntu3.3 AND libcurl3 DPKG is earlier than 7.21.6-3ubuntu3.3 AND Release section Ubuntu 10.04 is installed Packages match section curl DPKG is earlier than 7.19.7-1ubuntu1.2 AND libcurl3 DPKG is earlier than 7.19.7-1ubuntu1.2 AND Release section Ubuntu 8.04 is installed Packages match section curl DPKG is earlier than 7.18.0-1ubuntu2.4 AND libcurl3 DPKG is earlier than 7.18.0-1ubuntu2.4

Definition Id: oval:org.mitre.oval:def:18308

Oval ID:	oval:org.mitre.oval:def:18308
Title:	DSA-2713-1 curl - heap overflow
Description:	Timo Sirainen discovered that cURL, an URL transfer library, is prone to a heap overflow vulnerability due to bad checking of the input data in the curl_easy_unescape function.
Family:	unix	Class:	patch
Reference(s):	DSA-2713-1 CVE-2013-2174	Version:	8
Platform(s):	Debian GNU/Linux 6.0 Debian GNU/Linux 7 Debian GNU/kFreeBSD 6.0 Debian GNU/kFreeBSD 7	Product(s):	curl
Definition Synopsis:
Release section Debian 6.0 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND curl DPKG is earlier than 7.21.0-2.1+squeeze4 AND Release section Debian 7 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND curl DPKG is earlier than 7.26.0-1+wheezy3

Definition Id: oval:org.mitre.oval:def:18350

Oval ID:	oval:org.mitre.oval:def:18350
Title:	USN-1894-1 -- curl vulnerability
Description:	libcurl could be made to crash or run programs as your login if it receiv ed specially crafted input.
Family:	unix	Class:	patch
Reference(s):	USN-1894-1 CVE-2013-2174	Version:	7
Platform(s):	Ubuntu 13.04 Ubuntu 12.10 Ubuntu 12.04 Ubuntu 10.04	Product(s):	curl
Definition Synopsis:
Release section Ubuntu 13.04 is installed Packages match section libcurl3 DPKG is earlier than 7.29.0-1ubuntu3.1 AND libcurl3-gnutls DPKG is earlier than 7.29.0-1ubuntu3.1 AND libcurl3-nss DPKG is earlier than 7.29.0-1ubuntu3.1 AND Release section Ubuntu 12.10 is installed Packages match section libcurl3 DPKG is earlier than 7.27.0-1ubuntu1.3 AND libcurl3-gnutls DPKG is earlier than 7.27.0-1ubuntu1.3 AND libcurl3-nss DPKG is earlier than 7.27.0-1ubuntu1.3 AND Release section Ubuntu 12.04 is installed Packages match section libcurl3 DPKG is earlier than 7.22.0-3ubuntu4.2 AND libcurl3-gnutls DPKG is earlier than 7.22.0-3ubuntu4.2 AND libcurl3-nss DPKG is earlier than 7.22.0-3ubuntu4.2 AND Release section Ubuntu 10.04 is installed Packages match section libcurl3 DPKG is earlier than 7.19.7-1ubuntu1.3 AND libcurl3-gnutls DPKG is earlier than 7.19.7-1ubuntu1.3

Definition Id: oval:org.mitre.oval:def:20032

Oval ID:	oval:org.mitre.oval:def:20032
Title:	DSA-2660-1 curl - cookie leak vulnerability
Description:	Yamada Yasuharu discovered that cURL, an URL transfer library, is vulnerable to expose potentially sensitive information when doing requests across domains with matching tails. Due to a bug in the tail match function when matching domain names, it was possible that cookies set for a domain <q>ample.com</q> could accidentally also be sent by libcurl when communicating with <q>example.com</q>.
Family:	unix	Class:	patch
Reference(s):	DSA-2660-1 CVE-2013-1944	Version:	5
Platform(s):	Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0	Product(s):	curl
Definition Synopsis:
Debian 6.0 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND curl DPKG is earlier than 0:7.21.0-2.1+squeeze3

Definition Id: oval:org.mitre.oval:def:20136

Oval ID:	oval:org.mitre.oval:def:20136
Title:	DSA-2824-1 curl - unchecked tls/ssl certificate host name
Description:	Marc Deslauriers discovered that curl, a file retrieval tool, would mistakenly skip verifying the CN and SAN name fields when digital signature verification was disabled in the libcurl GnuTLS backend.
Family:	unix	Class:	patch
Reference(s):	DSA-2824-1 CVE-2013-6422	Version:	5
Platform(s):	Debian GNU/Linux 7 Debian GNU/kFreeBSD 7	Product(s):	curl
Definition Synopsis:
Debian 7 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND curl DPKG is earlier than 0:7.26.0-1+wheezy7

Definition Id: oval:org.mitre.oval:def:20280

Oval ID:	oval:org.mitre.oval:def:20280
Title:	RHSA-2013:0771: curl security update (Moderate)
Description:	The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
Family:	unix	Class:	patch
Reference(s):	RHSA-2013:0771-01 CESA-2013:0771 CVE-2013-1944	Version:	4
Platform(s):	Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 CentOS Linux 5 CentOS Linux 6	Product(s):	curl
Definition Synopsis:
Operation system section Redhat 6 or Centos 6 release The operating system installed on the system is Red Hat Enterprise Linux 6 AND CentOS Linux 6.x Packages section curl is earlier than 0:7.19.7-36.el6_4 AND libcurl-devel is earlier than 0:7.19.7-36.el6_4 AND libcurl is earlier than 0:7.19.7-36.el6_4 AND Operation system section Redhat 5 or Centos 5 release The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x Packages section curl is earlier than 0:7.15.5-16.el5_9 AND curl-devel is earlier than 0:7.15.5-16.el5_9

Definition Id: oval:org.mitre.oval:def:20581

Oval ID:	oval:org.mitre.oval:def:20581
Title:	USN-2058-1 -- curl vulnerability
Description:	Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet.
Family:	unix	Class:	patch
Reference(s):	USN-2058-1 CVE-2013-6422	Version:	5
Platform(s):	Ubuntu 13.10 Ubuntu 13.04 Ubuntu 12.10 Ubuntu 12.04	Product(s):	curl
Definition Synopsis:
Release section Ubuntu 13.10 is installed AND libcurl3-gnutls DPKG is earlier than 0:7.32.0-1ubuntu1.2 AND Release section Ubuntu 13.04 is installed AND libcurl3-gnutls DPKG is earlier than 0:7.29.0-1ubuntu3.4 AND Release section Ubuntu 12.10 is installed AND libcurl3-gnutls DPKG is earlier than 0:7.27.0-1ubuntu1.7 AND Release section Ubuntu 12.04 is installed AND libcurl3-gnutls DPKG is earlier than 0:7.22.0-3ubuntu4.6

Definition Id: oval:org.mitre.oval:def:21195

Oval ID:	oval:org.mitre.oval:def:21195
Title:	RHSA-2013:0983: curl security update (Moderate)
Description:	Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.
Family:	unix	Class:	patch
Reference(s):	RHSA-2013:0983-00 CESA-2013:0983 CVE-2013-2174	Version:	4
Platform(s):	Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 CentOS Linux 5 CentOS Linux 6	Product(s):	curl
Definition Synopsis:
Operation system section Redhat 6 or Centos 6 release The operating system installed on the system is Red Hat Enterprise Linux 6 AND CentOS Linux 6.x Packages section curl is earlier than 0:7.19.7-37.el6_4 AND libcurl-devel is earlier than 0:7.19.7-37.el6_4 AND libcurl is earlier than 0:7.19.7-37.el6_4 AND Operation system section Redhat 5 or Centos 5 release The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x Packages section curl is earlier than 0:7.15.5-17.el5_9 AND curl-devel is earlier than 0:7.15.5-17.el5_9

Definition Id: oval:org.mitre.oval:def:23483

Oval ID:	oval:org.mitre.oval:def:23483
Title:	DEPRECATED: ELSA-2013:0983: curl security update (Moderate)
Description:	Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.
Family:	unix	Class:	patch
Reference(s):	ELSA-2013:0983-00 CVE-2013-2174	Version:	7
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	curl
Definition Synopsis:
rpm test Oracle Linux 6.x AND rpm test curl is earlier than 0:7.19.7-37.el6_4 AND libcurl-devel is earlier than 0:7.19.7-37.el6_4 AND libcurl is earlier than 0:7.19.7-37.el6_4 OR rpm test Oracle Linux 5.x AND rpm test curl is earlier than 0:7.15.5-17.el5_9 AND curl-devel is earlier than 0:7.15.5-17.el5_9

Definition Id: oval:org.mitre.oval:def:23498

Oval ID:	oval:org.mitre.oval:def:23498
Title:	DEPRECATED: ELSA-2013:0771: curl security update (Moderate)
Description:	The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
Family:	unix	Class:	patch
Reference(s):	ELSA-2013:0771-01 CVE-2013-1944	Version:	7
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	curl
Definition Synopsis:
rpm test Oracle Linux 6.x AND rpm test curl is earlier than 0:7.19.7-36.el6_4 AND libcurl-devel is earlier than 0:7.19.7-36.el6_4 AND libcurl is earlier than 0:7.19.7-36.el6_4 OR rpm test Oracle Linux 5.x AND rpm test curl is earlier than 0:7.15.5-16.el5_9 AND curl-devel is earlier than 0:7.15.5-16.el5_9

Definition Id: oval:org.mitre.oval:def:23721

Oval ID:	oval:org.mitre.oval:def:23721
Title:	ELSA-2013:0983: curl security update (Moderate)
Description:	Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.
Family:	unix	Class:	patch
Reference(s):	ELSA-2013:0983-00 CVE-2013-2174	Version:	6
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	curl
Definition Synopsis:
rpm test Oracle Linux 6.x AND rpm test curl is earlier than 0:7.19.7-37.el6_4 AND libcurl-devel is earlier than 0:7.19.7-37.el6_4 AND libcurl is earlier than 0:7.19.7-37.el6_4 OR rpm test Oracle Linux 5.x AND rpm test curl is earlier than 0:7.15.5-17.el5_9 AND curl-devel is earlier than 0:7.15.5-17.el5_9

Definition Id: oval:org.mitre.oval:def:23950

Oval ID:	oval:org.mitre.oval:def:23950
Title:	ELSA-2013:0771: curl security update (Moderate)
Description:	The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
Family:	unix	Class:	patch
Reference(s):	ELSA-2013:0771-01 CVE-2013-1944	Version:	6
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	curl
Definition Synopsis:
rpm test Oracle Linux 6.x AND rpm test curl is earlier than 0:7.19.7-36.el6_4 AND libcurl-devel is earlier than 0:7.19.7-36.el6_4 AND libcurl is earlier than 0:7.19.7-36.el6_4 OR rpm test Oracle Linux 5.x AND rpm test curl is earlier than 0:7.15.5-16.el5_9 AND curl-devel is earlier than 0:7.15.5-16.el5_9

Definition Id: oval:org.mitre.oval:def:25538

Oval ID:	oval:org.mitre.oval:def:25538
Title:	SUSE-SU-2013:0773-1 -- Security update for curl, curl
Description:	This update fixes the cookie domain tailmatch vulnerability in curl. CVE-2013-1944 has been assigned to this issue. Also the CA-Cert Bundle has been updated to the current state. Security Issue reference: * CVE-2013-1944 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1944 >
Family:	unix	Class:	patch
Reference(s):	SUSE-SU-2013:0773-1 CVE-2013-1944	Version:	3
Platform(s):	SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10	Product(s):	curl
Definition Synopsis:
Operation system section SUSE Linux Enterprise Server 10 is installed AND SUSE Linux Enterprise Desktop 10 is installed Packages match section curl RPM is earlier than 0:7.15.1-19.26.1 AND curl-devel RPM is earlier than 0:7.15.1-19.26.1 AND curl-32bit RPM is earlier than 0:7.15.1-19.26.1

Definition Id: oval:org.mitre.oval:def:25795

Oval ID:	oval:org.mitre.oval:def:25795
Title:	SUSE-SU-2013:0772-1 -- Security update for compat-curl2
Description:	This update of compat-curl2 fixes several security issues. * fixes for the cookie domain tailmatch vulnerability (bnc#814655) * updated curl CA-Cert Bundle (bnc#810010) * fixes for a potential BEAST attack (bnc#742306) Security Issue reference: * CVE-2013-1944 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1944 >
Family:	unix	Class:	patch
Reference(s):	SUSE-SU-2013:0772-1 CVE-2013-1944	Version:	3
Platform(s):	SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10	Product(s):	compat-curl2
Definition Synopsis:
Operation system section SUSE Linux Enterprise Server 10 is installed AND SUSE Linux Enterprise Desktop 10 is installed Packages match section compat-curl2 RPM is earlier than 0:7.11.0-20.9.1 AND compat-curl2-32bit RPM is earlier than 0:7.11.0-20.9.1

Definition Id: oval:org.mitre.oval:def:25912

Oval ID:	oval:org.mitre.oval:def:25912
Title:	SUSE-SU-2013:1166-2 -- Security update for curl
Description:	This update of curl fixes several security issues. * libcurl URL decode buffer boundary flaw (bnc#824517 / CVE-2013-2174) Security Issue reference: * CVE-2013-2174 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2174 >
Family:	unix	Class:	patch
Reference(s):	SUSE-SU-2013:1166-2 CVE-2013-2174	Version:	3
Platform(s):	SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10	Product(s):	curl
Definition Synopsis:
Operation system section SUSE Linux Enterprise Server 10 is installed AND SUSE Linux Enterprise Desktop 10 is installed Packages match section curl RPM is earlier than 0:7.15.1-19.30.1 AND curl-devel RPM is earlier than 0:7.15.1-19.30.1 AND curl-32bit RPM is earlier than 0:7.15.1-19.30.1

Definition Id: oval:org.mitre.oval:def:25977

Oval ID:	oval:org.mitre.oval:def:25977
Title:	SUSE-SU-2013:1166-1 -- Security update for compat-curl2
Description:	This update of compat-curl2 fixes a security vulnerability: * libcurl URL decode buffer boundary flaw (bnc#824517 / CVE-2013-2174) Security Issue reference: * CVE-2013-2174 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2174 >
Family:	unix	Class:	patch
Reference(s):	SUSE-SU-2013:1166-1 CVE-2013-2174	Version:	3
Platform(s):	SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10	Product(s):	compat-curl2
Definition Synopsis:
SUSE Linux Enterprise Server 11 and SUSE Linux Enterprise Desktop 11 release section Operation system section SUSE Linux Enterprise Server 11.x is installed AND SUSE Linux Enterprise Desktop 11.x is installed Packages match section curl RPM is earlier than 0:7.19.7-1.28.1 AND libcurl4 RPM is earlier than 0:7.19.7-1.28.1 AND libcurl4-32bit RPM is earlier than 0:7.19.7-1.28.1 AND curl RPM is earlier than 0:7.19.7-1.20.27.1 AND libcurl4 RPM is earlier than 0:7.19.7-1.20.27.1 AND libcurl4-32bit RPM is earlier than 0:7.19.7-1.20.27.1 AND SUSE Linux Enterprise Server 10 and SUSE Linux Enterprise Desktop 10 release section Operation system section SUSE Linux Enterprise Server 10 is installed AND SUSE Linux Enterprise Desktop 10 is installed Packages match section compat-curl2 RPM is earlier than 0:7.11.0-20.11.1 AND compat-curl2-32bit RPM is earlier than 0:7.11.0-20.11.1

Definition Id: oval:org.mitre.oval:def:26023

Oval ID:	oval:org.mitre.oval:def:26023
Title:	SUSE-SU-2013:0771-1 -- Security update for curl
Description:	This update fixes the cookie domain tailmatch vulnerability in curl. CVE-2013-1944 has been assigned to this issue. Security Issue reference: * CVE-2013-1944 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1944 >
Family:	unix	Class:	patch
Reference(s):	SUSE-SU-2013:0771-1 CVE-2013-1944	Version:	3
Platform(s):	SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Desktop 11	Product(s):	curl
Definition Synopsis:
Operation system section SUSE Linux Enterprise Server 11.x is installed AND SUSE Linux Enterprise Desktop 11.x is installed Packages match section curl RPM is earlier than 0:7.19.7-1.20.25.1 AND libcurl4 RPM is earlier than 0:7.19.7-1.20.25.1 AND libcurl4-32bit RPM is earlier than 0:7.19.7-1.20.25.1

Definition Id: oval:org.mitre.oval:def:27292

Oval ID:	oval:org.mitre.oval:def:27292
Title:	DEPRECATED: ELSA-2013-0983 -- curl security update (moderate)
Description:	[7.19.7-37] - fix heap-based buffer overflow in curl_easy_unescape() (CVE-2013-2174)
Family:	unix	Class:	patch
Reference(s):	ELSA-2013-0983 CVE-2013-2174	Version:	4
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	curl
Definition Synopsis:
Oracle Linux 5 release section Oracle Linux 5.x Packages match section curl is earlier than 0:7.15.5-17.el5_9 AND curl-devel is earlier than 0:7.15.5-17.el5_9 AND Oracle Linux 6 release section Oracle Linux 6.x Packages match section curl is earlier than 0:7.19.7-37.el6_4 AND libcurl is earlier than 0:7.19.7-37.el6_4 AND libcurl-devel is earlier than 0:7.19.7-37.el6_4

Definition Id: oval:org.mitre.oval:def:27357

Oval ID:	oval:org.mitre.oval:def:27357
Title:	DEPRECATED: ELSA-2013-0771 -- curl security update (moderate)
Description:	[7.19.7-36] - fix cookie tailmatching to prevent cross-domain leakage (CVE-2013-1944)
Family:	unix	Class:	patch
Reference(s):	ELSA-2013-0771 CVE-2013-1944	Version:	4
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	curl
Definition Synopsis:
Oracle Linux 5 release section Oracle Linux 5.x Packages match section curl is earlier than 0:7.15.5-16.el5_9 AND curl-devel is earlier than 0:7.15.5-16.el5_9 AND Oracle Linux 6 release section Oracle Linux 6.x Packages match section curl is earlier than 0:7.19.7-36.el6_4 AND libcurl is earlier than 0:7.19.7-36.el6_4 AND libcurl-devel is earlier than 0:7.19.7-36.el6_4

CPE : Common Platform Enumeration

Type	Description	Count
Application	Haxx Curl cpe:2.3:a:haxx:curl:7.9.8:::::::* cpe:2.3:a:haxx:curl:7.9.7:::::::* cpe:2.3:a:haxx:curl:7.9.6:::::::* cpe:2.3:a:haxx:curl:7.9.5:::::::* cpe:2.3:a:haxx:curl:7.9.4:::::::* cpe:2.3:a:haxx:curl:7.9.3:::::::* cpe:2.3:a:haxx:curl:7.9.2:::::::* cpe:2.3:a:haxx:curl:7.9.1:::::::* cpe:2.3:a:haxx:curl:7.9:::::::* cpe:2.3:a:haxx:curl:7.8.1:::::::* cpe:2.3:a:haxx:curl:7.8:::::::* cpe:2.3:a:haxx:curl:7.7.3:::::::* cpe:2.3:a:haxx:curl:7.7.2:::::::* cpe:2.3:a:haxx:curl:7.7.1:::::::* cpe:2.3:a:haxx:curl:7.7:::::::* cpe:2.3:a:haxx:curl:7.6.1:::::::* cpe:2.3:a:haxx:curl:7.6:::::::* cpe:2.3:a:haxx:curl:7.5.2:::::::* cpe:2.3:a:haxx:curl:7.5.1:::::::* cpe:2.3:a:haxx:curl:7.5:::::::* cpe:2.3:a:haxx:curl:7.4.2:::::::* cpe:2.3:a:haxx:curl:7.4.1:::::::* cpe:2.3:a:haxx:curl:7.4:::::::* cpe:2.3:a:haxx:curl:7.30.0:::::::* cpe:2.3:a:haxx:curl:7.3:::::::* cpe:2.3:a:haxx:curl:7.29.0:::::::* cpe:2.3:a:haxx:curl:7.28.1:::::::* cpe:2.3:a:haxx:curl:7.28.0:::::::* cpe:2.3:a:haxx:curl:7.27.0:::::::* cpe:2.3:a:haxx:curl:7.26.0:::::::* cpe:2.3:a:haxx:curl:7.25.0:::::::* cpe:2.3:a:haxx:curl:7.24.0:::::::* cpe:2.3:a:haxx:curl:7.23.1:::::::* cpe:2.3:a:haxx:curl:7.23.0:::::::* cpe:2.3:a:haxx:curl:7.22.0:::::::* cpe:2.3:a:haxx:curl:7.21.7:::::::* cpe:2.3:a:haxx:curl:7.21.6:::::::* cpe:2.3:a:haxx:curl:7.21.5:::::::* cpe:2.3:a:haxx:curl:7.21.4:::::::* cpe:2.3:a:haxx:curl:7.21.3:::::::* cpe:2.3:a:haxx:curl:7.21.2:::::::* cpe:2.3:a:haxx:curl:7.21.1:::::::* cpe:2.3:a:haxx:curl:7.21.0:::::::* cpe:2.3:a:haxx:curl:7.20.1:::::::* cpe:2.3:a:haxx:curl:7.20.0:::::::* cpe:2.3:a:haxx:curl:7.2.1:::::::* cpe:2.3:a:haxx:curl:7.2:::::::* cpe:2.3:a:haxx:curl:7.19.7-53:::::::* cpe:2.3:a:haxx:curl:7.19.7:::::::* cpe:2.3:a:haxx:curl:7.19.6:::::::* cpe:2.3:a:haxx:curl:7.19.5:::::::* cpe:2.3:a:haxx:curl:7.19.4:::::::* cpe:2.3:a:haxx:curl:7.19.3:::::::* cpe:2.3:a:haxx:curl:7.19.2:::::::* cpe:2.3:a:haxx:curl:7.19.1:::::::* cpe:2.3:a:haxx:curl:7.19.0:::::::* cpe:2.3:a:haxx:curl:7.18.2:::::::* cpe:2.3:a:haxx:curl:7.18.1:::::::* cpe:2.3:a:haxx:curl:7.18.0:::::::* cpe:2.3:a:haxx:curl:7.17.1:::::::* cpe:2.3:a:haxx:curl:7.17.0:::::::* cpe:2.3:a:haxx:curl:7.16.4:::::::* cpe:2.3:a:haxx:curl:7.16.3:::::::* cpe:2.3:a:haxx:curl:7.16.2:::::::* cpe:2.3:a:haxx:curl:7.16.1:::::::* cpe:2.3:a:haxx:curl:7.16.0:::::::* cpe:2.3:a:haxx:curl:7.15.5:::::::* cpe:2.3:a:haxx:curl:7.15.4:::::::* cpe:2.3:a:haxx:curl:7.15.3:::::::* cpe:2.3:a:haxx:curl:7.15.2:::::::* cpe:2.3:a:haxx:curl:7.15.1:::::::* cpe:2.3:a:haxx:curl:7.15.0:::::::* cpe:2.3:a:haxx:curl:7.14.1:::::::* cpe:2.3:a:haxx:curl:7.14.0:::::::* cpe:2.3:a:haxx:curl:7.13.2:::::::* cpe:2.3:a:haxx:curl:7.13.1:::::::* cpe:2.3:a:haxx:curl:7.13.0:::::::* cpe:2.3:a:haxx:curl:7.12.3:::::::* cpe:2.3:a:haxx:curl:7.12.2:::::::* cpe:2.3:a:haxx:curl:7.12.1:::::::* cpe:2.3:a:haxx:curl:7.12.0:::::::* cpe:2.3:a:haxx:curl:7.11.2:::::::* cpe:2.3:a:haxx:curl:7.11.1:::::::* cpe:2.3:a:haxx:curl:7.11.0:::::::* cpe:2.3:a:haxx:curl:7.10.8:::::::* cpe:2.3:a:haxx:curl:7.10.7:::::::* cpe:2.3:a:haxx:curl:7.10.6:::::::* cpe:2.3:a:haxx:curl:7.10.5:::::::* cpe:2.3:a:haxx:curl:7.10.4:::::::* cpe:2.3:a:haxx:curl:7.10.3:::::::* cpe:2.3:a:haxx:curl:7.10.2:::::::* cpe:2.3:a:haxx:curl:7.10.1:::::::* cpe:2.3:a:haxx:curl:7.10:::::::* cpe:2.3:a:haxx:curl:7.1.1:::::::* cpe:2.3:a:haxx:curl:7.1:::::::* cpe:2.3:a:haxx:curl:6.5.2:::::::* cpe:2.3:a:haxx:curl:6.5.1:::::::* cpe:2.3:a:haxx:curl:6.5:::::::* cpe:2.3:a:haxx:curl:6.4:::::::* cpe:2.3:a:haxx:curl:6.3.1:::::::* cpe:2.3:a:haxx:curl:6.3:::::::* cpe:2.3:a:haxx:curl:6.2:::::::* cpe:2.3:a:haxx:curl:6.1:::::::* cpe:2.3:a:haxx:curl:6.1:beta:::::: cpe:2.3:a:haxx:curl:6.0:::::::* cpe:2.3:a:haxx:curl::::::::	106
Application	Haxx Libcurl cpe:2.3:a:haxx:libcurl:7.9.8:::::::* cpe:2.3:a:haxx:libcurl:7.9.7:::::::* cpe:2.3:a:haxx:libcurl:7.9.6:::::::* cpe:2.3:a:haxx:libcurl:7.9.5:::::::* cpe:2.3:a:haxx:libcurl:7.9.4:::::::* cpe:2.3:a:haxx:libcurl:7.9.3:::::::* cpe:2.3:a:haxx:libcurl:7.9.2:::::::* cpe:2.3:a:haxx:libcurl:7.9.1:::::::* cpe:2.3:a:haxx:libcurl:7.9:::::::* cpe:2.3:a:haxx:libcurl:7.8.1:::::::* cpe:2.3:a:haxx:libcurl:7.8:::::::* cpe:2.3:a:haxx:libcurl:7.7.3:::::::* cpe:2.3:a:haxx:libcurl:7.7.2:::::::* cpe:2.3:a:haxx:libcurl:7.7.1:::::::* cpe:2.3:a:haxx:libcurl:7.7:::::::* cpe:2.3:a:haxx:libcurl:7.6.1:::::::* cpe:2.3:a:haxx:libcurl:7.6:::::::* cpe:2.3:a:haxx:libcurl:7.5.2:::::::* cpe:2.3:a:haxx:libcurl:7.5.1:::::::* cpe:2.3:a:haxx:libcurl:7.5:::::::* cpe:2.3:a:haxx:libcurl:7.4.2:::::::* cpe:2.3:a:haxx:libcurl:7.4.1:::::::* cpe:2.3:a:haxx:libcurl:7.4:::::::* cpe:2.3:a:haxx:libcurl:7.33.0:::::::* cpe:2.3:a:haxx:libcurl:7.32.0:::::::* cpe:2.3:a:haxx:libcurl:7.31.0:::::::* cpe:2.3:a:haxx:libcurl:7.30.0:::::::* cpe:2.3:a:haxx:libcurl:7.3:::::::* cpe:2.3:a:haxx:libcurl:7.29.0:::::::* cpe:2.3:a:haxx:libcurl:7.28.1:::::::* cpe:2.3:a:haxx:libcurl:7.28.0:::::::* cpe:2.3:a:haxx:libcurl:7.27.0:::::::* cpe:2.3:a:haxx:libcurl:7.26.0:::::::* cpe:2.3:a:haxx:libcurl:7.25.0:::::::* cpe:2.3:a:haxx:libcurl:7.24.0:::::::* cpe:2.3:a:haxx:libcurl:7.23.1:::::::* cpe:2.3:a:haxx:libcurl:7.23.0:::::::* cpe:2.3:a:haxx:libcurl:7.22.0:::::::* cpe:2.3:a:haxx:libcurl:7.21.7:::::::* cpe:2.3:a:haxx:libcurl:7.21.6:::::::* cpe:2.3:a:haxx:libcurl:7.21.5:::::::* cpe:2.3:a:haxx:libcurl:7.21.4:::::::* cpe:2.3:a:haxx:libcurl:7.21.3:::::::* cpe:2.3:a:haxx:libcurl:7.21.2:::::::* cpe:2.3:a:haxx:libcurl:7.21.1:::::::* cpe:2.3:a:haxx:libcurl:7.21.0:::::::* cpe:2.3:a:haxx:libcurl:7.20.1:::::::* cpe:2.3:a:haxx:libcurl:7.20.0:::::::* cpe:2.3:a:haxx:libcurl:7.2.1:::::::* cpe:2.3:a:haxx:libcurl:7.2:::::::* cpe:2.3:a:haxx:libcurl:7.19.7:::::::* cpe:2.3:a:haxx:libcurl:7.19.6:::::::* cpe:2.3:a:haxx:libcurl:7.19.5:::::::* cpe:2.3:a:haxx:libcurl:7.19.4:::::::* cpe:2.3:a:haxx:libcurl:7.19.3:::::::* cpe:2.3:a:haxx:libcurl:7.19.2:::::::* cpe:2.3:a:haxx:libcurl:7.19.1:::::::* cpe:2.3:a:haxx:libcurl:7.19.0:::::::* cpe:2.3:a:haxx:libcurl:7.18.2:::::::* cpe:2.3:a:haxx:libcurl:7.18.1:::::::* cpe:2.3:a:haxx:libcurl:7.18.0:::::::* cpe:2.3:a:haxx:libcurl:7.17.1:::::::* cpe:2.3:a:haxx:libcurl:7.17.0:::::::* cpe:2.3:a:haxx:libcurl:7.16.4:::::::* cpe:2.3:a:haxx:libcurl:7.16.3:::::::* cpe:2.3:a:haxx:libcurl:7.16.2:::::::* cpe:2.3:a:haxx:libcurl:7.16.1:::::::* cpe:2.3:a:haxx:libcurl:7.16.0:::::::* cpe:2.3:a:haxx:libcurl:7.15.5:::::::* cpe:2.3:a:haxx:libcurl:7.15.4:::::::* cpe:2.3:a:haxx:libcurl:7.15.3:::::::* cpe:2.3:a:haxx:libcurl:7.15.2:::::::* cpe:2.3:a:haxx:libcurl:7.15.1:::::::* cpe:2.3:a:haxx:libcurl:7.15.0:::::::* cpe:2.3:a:haxx:libcurl:7.14.1:::::::* cpe:2.3:a:haxx:libcurl:7.14.0:::::::* cpe:2.3:a:haxx:libcurl:7.13.2:::::::* cpe:2.3:a:haxx:libcurl:7.13.1:::::::* cpe:2.3:a:haxx:libcurl:7.13.0:::::::* cpe:2.3:a:haxx:libcurl:7.12.3:::::::* cpe:2.3:a:haxx:libcurl:7.12.2:::::::* cpe:2.3:a:haxx:libcurl:7.12.1:::::::* cpe:2.3:a:haxx:libcurl:7.12.0:::::::* cpe:2.3:a:haxx:libcurl:7.11.2:::::::* cpe:2.3:a:haxx:libcurl:7.11.1:::::::* cpe:2.3:a:haxx:libcurl:7.11.0:::::::* cpe:2.3:a:haxx:libcurl:7.10.8:::::::* cpe:2.3:a:haxx:libcurl:7.10.7:::::::* cpe:2.3:a:haxx:libcurl:7.10.6:::::::* cpe:2.3:a:haxx:libcurl:7.10.5:::::::* cpe:2.3:a:haxx:libcurl:7.10.4:::::::* cpe:2.3:a:haxx:libcurl:7.10.3:::::::* cpe:2.3:a:haxx:libcurl:7.10.2:::::::* cpe:2.3:a:haxx:libcurl:7.10.1:::::::* cpe:2.3:a:haxx:libcurl:7.10:::::::* cpe:2.3:a:haxx:libcurl:7.1.1:::::::* cpe:2.3:a:haxx:libcurl:7.1:::::::* cpe:2.3:a:haxx:libcurl:6.5.2:::::::* cpe:2.3:a:haxx:libcurl:6.5.1:::::::* cpe:2.3:a:haxx:libcurl:6.5:::::::* cpe:2.3:a:haxx:libcurl:6.4:::::::* cpe:2.3:a:haxx:libcurl:6.3.1:::::::* cpe:2.3:a:haxx:libcurl:6.3:::::::* cpe:2.3:a:haxx:libcurl:6.2:::::::* cpe:2.3:a:haxx:libcurl:6.1:beta:::::: cpe:2.3:a:haxx:libcurl:6.1:::::::* cpe:2.3:a:haxx:libcurl:6.0:::::::* cpe:2.3:a:haxx:libcurl::::::::	108
Os	Canonical Ubuntu Linux cpe:2.3:o:canonical:ubuntu_linux:13.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:13.04:::::::* cpe:2.3:o:canonical:ubuntu_linux:12.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:::::* cpe:2.3:o:canonical:ubuntu_linux:11.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:::::* cpe:2.3:o:canonical:ubuntu_linux:8.04:-:lts:::::*	7
Os	Debian Debian Linux cpe:2.3:o:debian:debian_linux:7.0:::::::*	1
Os	Opensuse cpe:2.3:o:opensuse:opensuse:11.4:::::::*	1
Os	Redhat Enterprise Linux cpe:2.3:o:redhat:enterprise_linux:6.0:::::::* cpe:2.3:o:redhat:enterprise_linux:5:::::::*	2

ExploitDB Exploits

id	Description
2013-02-11	cURL Buffer Overflow Vulnerability

Snort® IPS/IDS

Date	Description
2014-01-10	libcurl MD5 digest buffer overflow attempt RuleID : 26391 - Revision : 3 - Type : PROTOCOL-POP

Nessus® Vulnerability Scanner

Date	Description
2016-06-22	Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2016-0056.nasl - Type : ACT_GATHER_INFO
2015-01-19	Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_libcurl_20140415.nasl - Type : ACT_GATHER_INFO
2014-11-28	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL15875.nasl - Type : ACT_GATHER_INFO
2014-11-08	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2013-1076.nasl - Type : ACT_GATHER_INFO
2014-10-08	Name : The remote web server is affected by multiple vulnerabilities. File : hpsmh_7_4.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-552.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-369.nasl - Type : ACT_GATHER_INFO
2014-01-21	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201401-14.nasl - Type : ACT_GATHER_INFO
2013-12-20	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2824.nasl - Type : ACT_GATHER_INFO
2013-12-19	Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2058-1.nasl - Type : ACT_GATHER_INFO
2013-12-19	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_4e1f4abc683711e39cda3c970e169bc2.nasl - Type : ACT_GATHER_INFO
2013-10-23	Name : The remote host is missing a Mac OS X update that fixes multiple security vul... File : macosx_10_9.nasl - Type : ACT_GATHER_INFO
2013-09-04	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2013-210.nasl - Type : ACT_GATHER_INFO
2013-07-23	Name : The remote Fedora host is missing a security update. File : fedora_2013-11568.nasl - Type : ACT_GATHER_INFO
2013-07-18	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_curl-130625.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-0771.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-0983.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Fedora host is missing a security update. File : fedora_2013-11521.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Fedora host is missing a security update. File : fedora_2013-11574.nasl - Type : ACT_GATHER_INFO
2013-07-11	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_curl-8614.nasl - Type : ACT_GATHER_INFO
2013-07-10	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_libcurl4-8618.nasl - Type : ACT_GATHER_INFO
2013-07-10	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_compat-curl2-8621.nasl - Type : ACT_GATHER_INFO
2013-07-10	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_curl-130618.nasl - Type : ACT_GATHER_INFO
2013-07-03	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1894-1.nasl - Type : ACT_GATHER_INFO
2013-06-28	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-180.nasl - Type : ACT_GATHER_INFO
2013-06-27	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-0983.nasl - Type : ACT_GATHER_INFO
2013-06-26	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0983.nasl - Type : ACT_GATHER_INFO
2013-06-26	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20130625_curl_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2013-06-25	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2713.nasl - Type : ACT_GATHER_INFO
2013-06-24	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_01cf67b3dc3b11e2a6cdc48508086173.nasl - Type : ACT_GATHER_INFO
2013-06-24	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2013-174-01.nasl - Type : ACT_GATHER_INFO
2013-05-26	Name : The remote Fedora host is missing a security update. File : fedora_2013-7797.nasl - Type : ACT_GATHER_INFO
2013-05-15	Name : The remote Fedora host is missing a security update. File : fedora_2013-7813.nasl - Type : ACT_GATHER_INFO
2013-05-09	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_curl-130416.nasl - Type : ACT_GATHER_INFO
2013-05-09	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_curl-8550.nasl - Type : ACT_GATHER_INFO
2013-05-06	Name : The remote Fedora host is missing a security update. File : fedora_2013-6766.nasl - Type : ACT_GATHER_INFO
2013-05-01	Name : The remote Fedora host is missing a security update. File : fedora_2013-6780.nasl - Type : ACT_GATHER_INFO
2013-04-29	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-151.nasl - Type : ACT_GATHER_INFO
2013-04-26	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20130424_curl_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2013-04-25	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0771.nasl - Type : ACT_GATHER_INFO
2013-04-25	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-0771.nasl - Type : ACT_GATHER_INFO
2013-04-22	Name : The remote Fedora host is missing a security update. File : fedora_2013-5598.nasl - Type : ACT_GATHER_INFO
2013-04-22	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2660.nasl - Type : ACT_GATHER_INFO
2013-04-18	Name : The remote Fedora host is missing a security update. File : fedora_2013-5618.nasl - Type : ACT_GATHER_INFO
2013-04-16	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1801-1.nasl - Type : ACT_GATHER_INFO
2013-02-25	Name : The remote Fedora host is missing a security update. File : fedora_2013-2098.nasl - Type : ACT_GATHER_INFO
2013-02-13	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1721-1.nasl - Type : ACT_GATHER_INFO
2013-02-08	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2013-038-01.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:38:03	Multiple Updates
2014-01-20 17:18:10	First insertion

Global Informations

Type	Count
CWE ID(s)	4
Oval ID(s)	20
CPE ID(s)	225
ExploitDB Exploit(s)	1
Snort® Rule(s)	1
Nessus® Exploit(s)	48

	Related
7.5	CVE-2013-0249
6.8	CVE-2013-2174
5	CVE-2013-1944
4	CVE-2013-6422
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 4 more Alert(s)

7.5 - GLSA-201401-14

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

ExploitDB Exploits

Snort® IPS/IDS

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU