CVE-2012-0036
CVE-2012-0036
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol.
EPSS 16,1% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
n/a
- Versiones
- n/a: Afectada
Sin corrección publicada
curl Debian:12
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.24.0-1
Actualiza a 7.24.0-1
curl Debian:13
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.24.0-1
Actualiza a 7.24.0-1
curl Debian:14
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.24.0-1
Actualiza a 7.24.0-1
Fuentes originales
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03760en_us
- http://www.securitytracker.com/id/1032924
- http://www.debian.org/security/2012/dsa-2398
- http://security.gentoo.org/glsa/glsa-201203-02.xml
- http://www.securityfocus.com/bid/51665
- http://secunia.com/advisories/48256
- http://curl.haxx.se/docs/adv_20120124.html
- http://curl.haxx.se/curl-url-sanitize.patch
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:058
- https://bugzilla.redhat.com/show_bug.cgi?id=773457
- http://support.apple.com/kb/HT5281
- https://github.com/bagder/curl/commit/75ca568fa1c19de4c5358fed246686de8467c238
- http://lists.apple.com/archives/security-announce/2012/May/msg00001.html
- https://nvd.nist.gov/vuln/detail/CVE-2012-0036