CVE-2020-8231High· 7.5▾ TwilightDue to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.8 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
3.8%
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
libcurl >= 7.29.0, <= 7.71.1sinec_infrastructure_network_services < 1.0.1.1debian_linux = 10.0communications_cloud_native_core_policy = 1.14.0universal_forwarder >= 8.2.0, < 8.2.12universal_forwarder >= 9.0.0, < 9.0.6universal_forwarder = 9.1.0Upgrade past the affected range:
sinec_infrastructure_network_services 1.0.1.1universal_forwarder 9.0.6Connected by shared product, vendor, weakness, or advisory.
CVE-2021-22901High· 8.1curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection
CVE-2020-8285High· 7.5curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
CVE-2020-8286High· 7.5curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
CVE-2021-3518High· 8.8There's a flaw in libxml2 in versions before 2.9.11
CVE-2020-1752High· 7.0A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out
CVE-2020-8284Low· 3.7A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and n…