The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0030 advisory.

    This advisory aggregates security fixes for the curl SRPM in CIQ LTS 8.6. It addresses 89 CVEs:
    CVE-2019-5481, CVE-2015-3148, CVE-2021-22922, CVE-2016-5420, CVE-2021-22924, and 84 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New curl packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

- fix FTP shutdown response buffer overflow     (CVE-2018-1000300)

  - fix RTSP bad headers buffer over-read (CVE-2018-1000301)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl to version 7.60.0 fixes the following issues :

These security issues were fixed :

  - CVE-2018-1000300: Prevent heap-based buffer overflow     when closing down an FTP connection with very long     server command replies (bsc#1092094).

  - CVE-2018-1000301: Prevent buffer over-read that could     have cause reading data beyond the end of a heap based     buffer used to store downloaded RTSP content     (bsc#1092098).

These non-security issues were fixed :

  - Add CURLOPT_HAPROXYPROTOCOL, support for the HAProxy     PROXY protocol

  - Add --haproxy-protocol for the command line tool

  - Add CURLOPT_DNS_SHUFFLE_ADDRESSES, shuffle returned IP     addresses 

  - FTP: fix typo in recursive callback detection for     seeking

  - test1208: marked flaky

  - HTTP: make header-less responses still count correct     body size

  - user-agent.d:: mention --proxy-header as well

- http2: fixes typo

  - cleanup: misc typos in strings and comments

  - rate-limit: use three second window to better handle     high speeds

  - examples/hiperfifo.c: improved

  - pause: when changing pause state, update socket state

  - curl_version_info.3: fix ssl_version description

  - add_handle/easy_perform: clear errorbuffer on start if     set

  - cmake: add support for brotli

  - parsedate: support UT timezone

  - vauth/ntlm.h: fix the #ifdef header guard

  - lib/curl_path.h: added #ifdef header guard

  - vauth/cleartext: fix integer overflow check

  - CURLINFO_COOKIELIST.3: made the example not leak memory

  - cookie.d: mention that '-' as filename means stdin

  - CURLINFO_SSL_VERIFYRESULT.3: fixed the example

- http2: read pending frames   (including GOAWAY) in connection-check

  - timeval: remove compilation warning by casting

  - cmake: avoid warn-as-error during config checks

  - travis-ci: enable -Werror for CMake builds

  - openldap: fix for NULL return from     ldap_get_attribute_ber()

  - threaded resolver: track resolver time and set suitable     timeout values

  - cmake: Add advapi32 as explicit link library for win32

  - docs: fix CURLINFO_*_T examples use of     CURL_FORMAT_CURL_OFF_T

  - test1148: set a fixed locale for the test

  - cookies: when reading from a file, only remove_expired     once

  - cookie: store cookies per top-level-domain-specific hash     table

  - openssl: RESTORED verify locations when verifypeer==0

  - file: restore old behavior for file:////foo/bar URLs

  - FTP: allow PASV on IPv6 connections when a proxy is     being used

  - build-openssl.bat: allow custom paths for VS and perl

  - winbuild: make the clean target work without build-type

  - build-openssl.bat: Refer to VS2017 as VC14.1 instead of     VC15

  - curl: retry on FTP 4xx, ignore other protocols

  - configure: detect (and use) sa_family_t

  - examples/sftpuploadresume: Fix Windows large file seek

  - build: cleanup to fix clang warnings/errors

  - winbuild: updated the documentation

  - lib: silence null-dereference warnings

  - travis: bump to clang 6 and gcc 7

  - travis: build libpsl and make builds use it

  - proxy: show getenv proxy use in verbose output

  - duphandle: make sure CURLOPT_RESOLVE is duplicated

  - all: Refactor malloc+memset to use calloc

  - checksrc: Fix typo

  - system.h: Add sparcv8plus to oracle/sunpro 32-bit     detection

  - vauth: Fix typo

  - ssh: show libSSH2 error code when closing fails

  - test1148: tolerate progress updates better

  - urldata: make service names unconditional

  - configure: keep LD_LIBRARY_PATH changes local

  - ntlm_sspi: fix authentication using Credential Manager

  - schannel: add client certificate authentication

  - winbuild: Support custom devel paths for each dependency

  - schannel: add support for CURLOPT_CAINFO

- http2: handle on_begin_headers() called more than once

  - openssl: support OpenSSL 1.1.1 verbose-mode trace     messages

  - openssl: fix subjectAltName check on non-ASCII platforms

- http2: avoid strstr() on data not zero terminated

- http2: clear the 'drain counter' when a stream is closed

- http2: handle GOAWAY properly

  - tool_help: clarify --max-time unit of time is seconds

  - curl.1: clarify that options and URLs can be mixed

- http2: convert an assert to run-time check

  - curl_global_sslset: always provide available backends

  - ftplistparser: keep state between invokes

  - Curl_memchr: zero length input can't match

  - examples/sftpuploadresume: typecast fseek argument to     long

  - examples/http2-upload: expand buffer to avoid silly     warning

  - ctype: restore character classification for non-ASCII     platforms

  - mime: avoid NULL pointer dereference risk

  - cookies: ensure that we have cookies before writing jar

  - os400.c: fix checksrc warnings

  - configure: provide --with-wolfssl as an alias for
    --with-cyassl

  - cyassl: adapt to libraries without TLS 1.0 support     built-in

- http2: get rid of another strstr

  - checksrc: force indentation of lines after an else

  - cookies: remove unused macro

  - CURLINFO_PROTOCOL.3: mention the existing defined names

  - tests: provide 'manual' as a feature to optionally     require

  - travis: enable libssh2 on both macos and Linux

  - CURLOPT_URL.3: added ENCODING section

  - wolfssl: Fix non-blocking connect

  - vtls: don't define MD5_DIGEST_LENGTH for wolfssl

  - docs: remove extraneous commas in man pages

  - URL: fix ASCII dependency in strcpy_url and strlen_url

  - ssh-libssh.c: fix left shift compiler warning

  - configure: only check for CA bundle for file-using SSL     backends

  - travis: add an mbedtls build

- http: don't set the 'rewind' flag when not uploading anything

  - configure: put CURLDEBUG and DEBUGBUILD in     lib/curl_config.h

  - transfer: don't unset writesockfd on setup of     multiplexed conns

  - vtls: use unified 'supports' bitfield member in backends

  - URLs: fix one more http url

  - travis: add a build using WolfSSL

  - openssl: change FILE ops to BIO ops

  - travis: add build using NSS

  - smb: reject negative file sizes

  - cookies: accept parameter names as cookie name

- http2: getsock fix for uploads

  - all over: fixed format specifiers

- http2: use the correct function pointer typedef

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities:

  - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is     enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary     requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3)     execute arbitrary commands via a redirect to an scp: URL. (CVE-2009-0037)

  - The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl     and other products, always performs credential delegation during GSSAPI authentication, which allows     remote servers to impersonate clients via GSSAPI requests. (CVE-2011-2192)

  - curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a     pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as     demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol. (CVE-2012-0036)

  - Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl     and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in     the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message. (CVE-2013-0249)

  - The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path     domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the     domain of a URL. (CVE-2013-1944)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

cURL security problems :

CVE-2018-1000300: FTP shutdown response buffer overflow

curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.

When doing FTP transfers, curl keeps a spare 'closure handle' around internally that will be used when an FTP connection gets shut down since the original curl easy handle is then already removed.

FTP server response data that gets cached from the original transfer might then be larger than the default buffer size (16 KB) allocated in the 'closure handle', which can lead to a buffer overwrite. The contents and size of that overwrite is controllable by the server.

This situation was detected by an assert() in the code, but that was of course only preventing bad stuff in debug builds. This bug is very unlikely to trigger with non-malicious servers.

We are not aware of any exploit of this flaw.

CVE-2018-1000301: RTSP bad headers buffer over-read

curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded content.

When servers send RTSP responses back to curl, the data starts out with a set of headers. curl parses that data to separate it into a number of headers to deal with those appropriately and to find the end of the headers that signal the start of the 'body' part.

The function that splits up the response into headers is called Curl_http_readwrite_headers() and in situations where it can't find a single header in the buffer, it might end up leaving a pointer pointing into the buffer instead of to the start of the buffer which then later on may lead to an out of buffer read when code assumes that pointer points to a full buffer size worth of memory to use.

This could potentially lead to information leakage but most likely a crash/denial of service for applications if a server triggers this flaw.

We are not aware of any exploit of this flaw.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3648-1 advisory.

    Dario Weisser discovered that curl incorrectly handled long FTP server command replies. If a user or     automated system were tricked into connecting to a malicious FTP server, a remote attacker could use this     issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This     issue only affected Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2018-1000300)

    Max Dymond discovered that curl incorrectly handled certain RTSP responses. If a user or automated system     were tricked into connecting to a malicious server, a remote attacker could use this issue to cause curl     to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2018-1000301)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201806-05 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause a Denial of Service condition, obtain       sensitive information, or have other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
359305	Rocky Linux 8.6 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / curl-minimal / etc Multiple Vulnerabilities (ciqsa-2026_0030)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/12/2026	critical
109870	Slackware 14.0 / 14.1 / 14.2 / current : curl (SSA:2018-136-01)	Nessus	Slackware Local Security Checks	5/17/2018	10/7/2024	critical
110061	Fedora 27 : curl (2018-9dc7338487)	Nessus	Fedora Local Security Checks	5/24/2018	10/3/2024	critical
123190	openSUSE Security Update : curl (openSUSE-2019-435)	Nessus	SuSE Local Security Checks	3/27/2019	6/12/2024	critical
206854	NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)	Nessus	NewStart CGSL Local Security Checks	9/10/2024	9/10/2024	critical
109877	FreeBSD : cURL -- multiple vulnerabilities (04fe6c8d-2a34-4009-a81e-e7a7e759b5d2)	Nessus	FreeBSD Local Security Checks	5/17/2018	10/4/2024	critical
109893	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : curl vulnerabilities (USN-3648-1)	Nessus	Ubuntu Local Security Checks	5/17/2018	9/3/2025	critical
110614	GLSA-201806-05 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	6/20/2018	9/17/2024	critical
120931	Fedora 28 : curl (2018-fa01002d7e)	Nessus	Fedora Local Security Checks	1/3/2019	6/28/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical