Security bypass vulnerabilities in cURL

Beschreibung

Multiple serious vulnerabilities have been found in cURL. Malicious users can exploit these vulnerabilities to bypass security restrictions.

Below is a complete list of vulnerabilities

1. Use-after-free vulnerability can be exploited to control which connection is used;
2. An improper TLS connection reuse handling can be exploited remotely via connection manipulations to hijack authentication;
3. An improper TLS certificate change handling can be exploited remotely via connection manipulations to bypass security restrictions.

---

Technical details

The curl command line tool is also affected because of these flaws.

All vulnerabilities were found in libcurl library.

Ursprüngliche Informationshinweise

• cURL vulnerabilities table and advisories

CVE Liste

• CVE-2016-5421
  critical
• CVE-2016-5420
  critical
• CVE-2016-5419
  critical

Mehr erfahren

Informieren Sie sich über die Statistiken der in Ihrer Region verbreiteten Sicherheitslücken statistics.securelist.com