Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
osvGoogleOSV:DSA-2398-1
HistoryMar 31, 2012 - 12:00 a.m.

curl - several

2012-03-3100:00:00
Google
osv.dev
16

0.009 Low

EPSS

Percentile

83.0%

JSON

Several vulnerabilities have been discovered in cURL, an URL transfer
library. The Common Vulnerabilities and Exposures project identifies the
following problems:

  • CVE-2011-3389
    This update enables OpenSSL workarounds against the BEAST attack.
    Additional information can be found in the cURL advisory
  • CVE-2012-0036
    Dan Fandrich discovered that cURL performs insufficient sanitising
    when extracting the file path part of an URL.

For the oldstable distribution (lenny), this problem has been fixed in
version 7.18.2-8lenny6.

For the stable distribution (squeeze), this problem has been fixed in
version 7.21.0-2.1+squeeze2.

For the unstable distribution (sid), this problem has been fixed in
version 7.24.0-1.

We recommend that you upgrade your curl packages.

CPENameOperatorVersion
curleq7.21.0-1
curleq7.21.0-2

Related

debian 5
openvas 74
nessus 41
gentoo 1
securityvulns 13
cve 3
ubuntucve 2
nvd 3
ubuntu 1
debiancve 2
prion 2
cvelist 2
fedora 23
mskb 1
veracode 2
checkpoint_security 1
ibm 9
cert 1
ics 1
checkpoint_advisories 2
seebug 2
freebsd 2
rubygems 1
f5 2
osv 2
rapid7blog 1
debian
debian
[SECURITY] [DSA 2398-1] curl security update
2012-01-30 19:49:07
[SECURITY] [DSA 2398-2] curl regression
2012-03-31 19:38:57
[SECURITY] [DSA 2368-1] lighttpd security update
2011-12-21 00:24:51
openvas
openvas
Mandriva Update for curl MDVSA-2012:058 (curl)
2012-08-03 00:00:00
Mandriva Update for curl MDVSA-2012:058 (curl)
2012-08-03 00:00:00
Debian Security Advisory DSA 2398-1 (curl)
2012-02-12 00:00:00
nessus
nessus
Debian DSA-2398-2 : curl - several vulnerabilities (BEAST)
2012-01-31 00:00:00
Mandriva Linux Security Advisory : curl (MDVSA-2012:058)
2012-04-16 00:00:00
openSUSE Security Update : curl (openSUSE-2012-76) (BEAST)
2014-06-13 00:00:00
gentoo
gentoo
cURL: Multiple vulnerabilities
2012-03-06 00:00:00
securityvulns
securityvulns
[USN-1346-1] curl vulnerability
2012-02-08 00:00:00
curl data injection
2012-02-08 00:00:00
ESA-2012-032: RSA BSAFE® Micro Edition Suite Security Update for BEAST (Browser Exploit Against SSL/TLS) attacks
2014-05-05 00:00:00
cve
cve
CVE-2012-0036
2012-04-13 20:55:01
CVE-2011-3389
2011-09-06 19:55:03
CVE-2004-2770
2011-09-25 10:55:04
ubuntucve
ubuntucve
CVE-2012-0036
2012-01-24 00:00:00
CVE-2011-3389
2011-11-16 00:00:00
nvd
nvd
CVE-2012-0036
2012-04-13 20:55:01
CVE-2011-3389
2011-09-06 19:55:03
CVE-2004-2770
2011-09-25 10:55:04
ubuntu
ubuntu
curl vulnerability
2012-01-24 00:00:00
debiancve
debiancve
CVE-2012-0036
2012-04-13 20:55:01
CVE-2011-3389
2011-09-06 19:55:03
prion
prion
Crlf injection
2012-04-13 20:55:00
Session fixation
2011-09-06 19:55:00
cvelist
cvelist
CVE-2012-0036
2012-04-13 20:00:00
CVE-2011-3389
2011-09-06 19:00:00
fedora
fedora
[SECURITY] Fedora 16 Update: curl-7.21.7-6.fc16
2012-01-28 03:31:08
[SECURITY] Fedora 16 Update: xulrunner-9.0-2.fc16
2011-12-23 03:31:27
[SECURITY] Fedora 16 Update: nss-softokn-3.13.1-14.fc16
2011-12-23 03:31:27
mskb
mskb
MS12-006: Vulnerability in SSL/TLS could allow information disclosure: January 10, 2012
2012-01-10 00:00:00
veracode
veracode
Man-in-the-Middle (MitM)
2019-05-02 04:55:58
Blockwise Chosen-boundary Attacks
2017-04-27 06:38:37
checkpoint_security
checkpoint_security
Check Point response to CVE-2011-3389 aka BEAST attack
2012-10-15 22:00:00
ibm
ibm
Security Bulletin: Vulnerabilities in SSL and TLS protocols affect the IBM FlashSystem V840 (CVE-2011-3389)
2018-06-18 00:09:28
Security Bulletin: IBM System x and Flex Systems Browser Exploit Against SSL/TLS (BEAST) Mitigations (CVE-2011-3389)
2022-05-16 16:03:13
Security Bulletin: Vulnerabilities in SSL and TLS protocols affects SAN Volume Controller and Storwize Family (CVE-2011-3389)
2022-08-20 00:54:31
cert
cert
SSL 3.0 and TLS 1.0 allow chosen plaintext attack in CBC modes
2011-09-27 00:00:00
ics
ics
Siemens Ruggedcom WIN Products BEAST Attack Vulnerability
2018-09-06 12:00:00
checkpoint_advisories
checkpoint_advisories
Preemptive Protection against SSL and TLS Protocols Information Disclosure (MS12-006; CVE-2011-3389)
2012-01-10 00:00:00
Web Servers SSL Flooding Denial of Service (CVE-2011-3389)
2011-11-06 00:00:00
seebug
seebug
Microsoft Windows SSL/TLS信息泄露漏洞
2011-09-29 00:00:00
Apple XCode 4.x 信息泄露漏洞
2012-07-27 00:00:00
freebsd
freebsd
fetchmail -- chosen plaintext attack against SSL CBC initialization vectors
2012-01-19 00:00:00
asterisk -- Multiple vulnerabilities
2016-02-03 00:00:00
rubygems
rubygems
CVE-2011-3389 HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)
2011-08-31 00:00:00
f5
f5
K13400 : SSL 3.0/TLS 1.0 vulnerability CVE-2011-3389 and TLS protocol vulnerability CVE-2012-1870
2015-06-16 00:00:00
SOL13400 - SSL 3.0/TLS 1.0 BEAST vulnerability CVE-2011-3389 and TLS protocol vulnerability CVE-2012-1870
2012-03-06 00:00:00
osv
osv
lighttpd - several
2011-12-20 00:00:00
nss - security update
2015-02-16 00:00:00
rapid7blog
rapid7blog
New Rapid7 MDR Essentials Capability Sees What Attackers See: “It’s Eye-Opening”
2021-09-01 13:11:33

0.009 Low

EPSS

Percentile

83.0%

JSON
Related for OSV:DSA-2398-1
debian5openvas74nessus41gentoo1securityvulns13cve3ubuntucve2nvd3ubuntu1debiancve2prion2cvelist2fedora23mskb1veracode2checkpoint_security1ibm9cert1ics1checkpoint_advisories2seebug2freebsd2rubygems1f52osv2rapid7blog1