A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine. The curl project fixed it on October 14 in curl 8.23.0. Taking over a client needs exact knowledge of its build and memory layout, and curl... Weiterlesen: curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Co…
Intelligence View
⚡ tsecurity.de Intelligence
curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned…
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!
Powered by tsecurity.de
tsecurity.de Hub
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
★★★★★
Noch keine Leser-Bewertungen
War diese Seite hilfreich?
0
Powered by tsecurity.de
tsecurity.de Hub
Verwandte Story-Cluster & Quellen (Vektor-KI)
10 Quellen
CVE-2022-47653 | GPAC 2.1-DEV-rev593-g007bf61a0 MP4box media_tools/av_parsers.c eac3_update_channels buffer overflow (Issue 2349 / EUVD-2022-50412)
9 weitere Quellen
VVulDB Updatesvor 3 Std.CVE-2022-47654 | GPAC 2.1-DEV-rev593-g007bf61a0 MP4box media_tools/av_parsers.c gf_hevc_read_sps_bs_internal buffer overflow (Issue 2350 / EUVD-2022-50413) VVulDB Updatesvor 3 Std.CVE-2022-47656 | GPAC 2.1-DEV-rev617-g85ce76efd MP4box media_tools/av_parsers.c gf_hevc_read_sps_bs_internal buffer overflow (Issue 2353 / EUVD-2022-50415) VVulDB Updatesvor 3 Std.CVE-2022-47659 | GPAC 2.1-DEV-rev644-g5c4df2a67 MP4box gf_bs_read_data buffer overflow (Issue 2354 / EUVD-2022-50418) VVulDB Updatesvor 3 Std.CVE-2022-47658 | GPAC 2.1-DEV-rev644-g5c4df2a67 MP4Box media_tools/av_parsers.c gf_hevc_read_vps_bs_internal buffer overflow (Issue 2356 / EUVD-2022-50417) VVulDB Updatesvor 3 Std.CVE-2022-47657 | GPAC 2.1-DEV-rev644-g5c4df2a67 MP4Box media_tools/av_parsers.c hevc_parse_vps_extension buffer overflow (Issue 2355 / EUVD-2022-50416) VVulDB Updatesvor 3 Std.CVE-2022-47660 | GPAC 2.1-DEV-rev644-g5c4df2a67 MP4Box isomedia/isom_write.c integer overflow (Issue 2357 / EUVD-2022-50419)
+3
9 Quellen
GitHub Release: cli/cli v2.103.2 (23.10.2026)
8 weitere Quellen
GGitHubvor 46 Min.GitHub Release: openclaw/openclaw vrelease-publish/3f5d04f8ebc9-1792785124 (23.10.2026) GGitHubvor 41 Min.GitHub Release: openclaw/openclaw vrelease-publish/4d13198000c5-1792785240 (23.10.2026) GGitHubvor 1 Std.GitHub Release: google/clusterfuzz v2.46.1 (23.10.2026) GGitHubvor 1 Std.GitHub Release: matomo-org/matomo v6.0.0-b7.20261023180549 (23.10.2026) GGitHubvor 2 Std.GitHub Release: openclaw/openclaw vrelease-publish/68bc4fc69776-1792777683 (23.10.2026) GGitHubvor 2 Std.GitHub Release: openclaw/openclaw vrelease-publish/6cc605dfe204-1792778379 (23.10.2026)
+2
8 Quellen
CVE-2025-68729 | Linux Kernel up to 6.17.12/6.18.1 wifi ath12k_hal_desc_reo_parse_err buffer overflow (Nessus ID 279834 / WID-SEC-2025-2920)
7 weitere Quellen
VVulDB Updatesvor 2 Std.CVE-2025-68374 | Linux Kernel up to 6.12.62/6.17.12/6.18.1 md_wakeup_thread use after free (Nessus ID 279706 / WID-SEC-2025-2920) VVulDB Updatesvor 2 Std.CVE-2025-68359 | Linux Kernel up to 6.17.12/6.18.1 btrfs kfree double free (Nessus ID 279727 / WID-SEC-2025-2920) VVulDB Updatesvor 2 Std.CVE-2025-68360 | Linux Kernel up to 6.17.12/6.18.1 wed_hif2 state issue (Nessus ID 279699 / WID-SEC-2025-2920) VVulDB Updatesvor 2 Std.CVE-2025-68368 | Linux Kernel up to 6.18.1 md_run null pointer dereference (Nessus ID 279769 / WID-SEC-2025-2920) VVulDB Updatesvor 2 Std.CVE-2025-68356 | Linux Kernel up to 6.12.62/6.17.12/6.18.1 new_inode allocation of resources (Nessus ID 279734 / WID-SEC-2025-2920) VVulDB Updatesvor 2 Std.CVE-2025-68353 | Linux Kernel up to 6.18.1 net vxlan_xmit_one null pointer dereference (Nessus ID 279713 / WID-SEC-2025-2920)
+1
Mehr aus dieser Kategorie
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
HAND-OFF
Auf Smartphone übergeben (ADVISORY)
Scannen Sie den QR-Code mit der Smartphone-Kamera für sofortigen mobilen Zugriff:
https://tsecurity.de/de/4271649/it-security-nachrichten/curl-patches-http2-upload-flaw-after-poc-demonstrates-client-side-code-execution/