Non notée
CVE-2019-5443 A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/)…
Description
A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| curl 7.65 | premières → 7.65.1 | Pas de correctif indiqué |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
Références
- [oss-security] 20190624 curl: Windows OpenSSL engine code injection www.openwall.com
- 108881 www.securityfocus.com
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- curl.haxx.se curl.haxx.se
- security.netapp.com security.netapp.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de curl
Les 4 CVE de curl →
CVE-2016-4606
Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute…
Non notée
CVE-2019-5482
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3
9.8
Critique
CVE-2019-5481
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3
9.8
Critique