[Forgot Password]
Login  Register Subscribe

30481

 
 

423868

 
 

255116

 
 

909

 
 

198683

 
 

282

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2022-35260Date: (C)2022-11-22   (M)2024-06-14


curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : 6.5CVSS Score :
Exploit Score: 2.8Exploit Score:
Impact Score: 3.6Impact Score:
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: NETWORKAccess Vector:
Attack Complexity: LOWAccess Complexity:
Privileges Required: NONEAuthentication:
User Interaction: REQUIREDConfidentiality:
Scope: UNCHANGEDIntegrity:
Confidentiality: NONEAvailability:
Integrity: NONE 
Availability: HIGH 
  
Reference:
http://seclists.org/fulldisclosure/2023/Jan/19
http://seclists.org/fulldisclosure/2023/Jan/20
GLSA-202212-01
https://hackerone.com/reports/1721098
https://security.netapp.com/advisory/ntap-20230110-0006/
https://support.apple.com/kb/HT213604
https://support.apple.com/kb/HT213605

CWE    1
CWE-787
OVAL    10
oval:org.secpod.oval:def:87036
oval:org.secpod.oval:def:85075
oval:org.secpod.oval:def:87033
oval:org.secpod.oval:def:124409
...

© SecPod Technologies