Search for packages
| purl | pkg:alpm/archlinux/libcurl-gnutls@7.52.1-1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-h5nc-szhe-aaaj
Aliases: CVE-2017-7468 |
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range. |
Affected by 0 other vulnerabilities. |
|
VCID-scf2-8apg-aaap
Aliases: CVE-2017-2629 |
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status). |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-bat6-t5kp-aaam | curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks. |
CVE-2016-9586
|
| VCID-d549-5ckr-aaaf | curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable. |
CVE-2016-9594
|
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2025-03-28T07:47:00.884190+00:00 | Arch Linux Importer | Fixing | VCID-bat6-t5kp-aaam | https://security.archlinux.org/AVG-114 | 36.0.0 |
| 2025-03-28T07:47:00.863297+00:00 | Arch Linux Importer | Fixing | VCID-d549-5ckr-aaaf | https://security.archlinux.org/AVG-114 | 36.0.0 |
| 2025-03-28T07:47:00.211210+00:00 | Arch Linux Importer | Affected by | VCID-scf2-8apg-aaap | https://security.archlinux.org/AVG-181 | 36.0.0 |
| 2025-03-28T07:47:00.192265+00:00 | Arch Linux Importer | Affected by | VCID-h5nc-szhe-aaaj | https://security.archlinux.org/AVG-181 | 36.0.0 |
| 2024-10-20T17:34:03.869610+00:00 | Arch Linux Importer | Fixing | VCID-bat6-t5kp-aaam | https://security.archlinux.org/AVG-114 | 34.0.2 |
| 2024-10-20T17:34:03.846510+00:00 | Arch Linux Importer | Fixing | VCID-d549-5ckr-aaaf | https://security.archlinux.org/AVG-114 | 34.0.2 |
| 2024-09-18T02:02:23.081590+00:00 | Arch Linux Importer | Fixing | VCID-bat6-t5kp-aaam | https://security.archlinux.org/AVG-114 | 34.0.1 |
| 2024-09-18T02:02:23.056305+00:00 | Arch Linux Importer | Fixing | VCID-d549-5ckr-aaaf | https://security.archlinux.org/AVG-114 | 34.0.1 |
| 2024-09-18T02:02:22.244259+00:00 | Arch Linux Importer | Affected by | VCID-scf2-8apg-aaap | https://security.archlinux.org/AVG-181 | 34.0.1 |
| 2024-09-18T02:02:22.223805+00:00 | Arch Linux Importer | Affected by | VCID-h5nc-szhe-aaaj | https://security.archlinux.org/AVG-181 | 34.0.1 |
| 2024-01-31T12:10:01.317036+00:00 | Arch Linux Importer | Fixing | VCID-bat6-t5kp-aaam | https://security.archlinux.org/AVG-114 | 34.0.0rc2 |
| 2024-01-31T12:10:01.295112+00:00 | Arch Linux Importer | Fixing | VCID-d549-5ckr-aaaf | https://security.archlinux.org/AVG-114 | 34.0.0rc2 |
| 2024-01-03T22:28:24.516968+00:00 | Arch Linux Importer | Fixing | VCID-bat6-t5kp-aaam | https://security.archlinux.org/AVG-114 | 34.0.0rc1 |
| 2024-01-03T22:28:24.490787+00:00 | Arch Linux Importer | Fixing | VCID-d549-5ckr-aaaf | https://security.archlinux.org/AVG-114 | 34.0.0rc1 |
| 2024-01-03T22:28:23.713813+00:00 | Arch Linux Importer | Affected by | VCID-scf2-8apg-aaap | https://security.archlinux.org/AVG-181 | 34.0.0rc1 |
| 2024-01-03T22:28:23.688960+00:00 | Arch Linux Importer | Affected by | VCID-h5nc-szhe-aaaj | https://security.archlinux.org/AVG-181 | 34.0.0rc1 |