According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The default configuration for cURL and libcurl before     7.42.1 sends custom HTTP headers to both the proxy and     destination server, which might allow remote proxy     servers to obtain sensitive information by reading the     header contents.(CVE-2015-3153)

  - curl before version 7.51.0 uses outdated IDNA 2003     standard to handle International Domain Names and this     may lead users to potentially and unknowingly issue     network transfer requests to the wrong     host.(CVE-2016-8625)

  - Heap buffer overflow in the TFTP protocol handler in     cURL 7.19.4 to 7.65.3.(CVE-2019-5482)

  - Curl versions 7.14.1 through 7.61.1 are vulnerable to a     heap-based buffer over-read in the tool_msgs.c:voutf()     function that may result in information exposure and     denial of service.(CVE-2018-16842)

  - The ConnectionExists function in lib/url.c in libcurl     before 7.47.0 does not properly re-use     NTLM-authenticated proxy connections, which might allow     remote attackers to authenticate as other users via a     request, a similar issue to     CVE-2014-0015.(CVE-2016-0755)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
131902	EulerOS 2.0 SP2 : curl (EulerOS-SA-2019-2410)	Nessus	Huawei Local Security Checks	12/10/2019	4/4/2024	critical
164599	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.5)	Nessus	Misc.	9/1/2022	4/8/2024	critical
164556	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.0.5)	Nessus	Misc.	9/1/2022	3/8/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical