The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2013-534:01 advisory.

    cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using     any of the supported protocols. cURL is designed to work without user interaction or any kind of     interactivity. cURL offers many useful capabilities, like proxy support, user authentication, FTP upload,     HTTP post, and file transfer resume.
    Security issues fixed with this release:
     CVE-2013-2174     No information available at the time of writing, please refer to the CVE link below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A heap-based buffer overflow flaw was found in the way libcurl unescaped URLs. A remote attacker could provide a specially crafted URL that, when processed by an application using libcurl that handles untrusted URLs, would possibly cause it to crash or, potentially, execute arbitrary code. (CVE-2013-2174)

All running applications using libcurl must be restarted for the update to take effect.

Timo Sirainen discovered that libcurl incorrectly handled memory when parsing URL encoded strings. An attacker could possibly use this issue to cause libcurl to crash, leading to a denial of service, or execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2013-2174 - fix heap-based buffer overflow in curl_easy_unescape()

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Solaris system is missing necessary patches to address security updates :

  - The tailMatch function in cookie.c in cURL and libcurl     before 7.30.0 does not properly match the path domain     when sending cookies, which allows remote attackers to     steal cookies via a matching suffix in the domain of a     URL. (CVE-2013-1944)

  - Heap-based buffer overflow in the curl_easy_unescape     function in lib/escape.c in cURL and libcurl 7.7 through     7.30.0 allows remote attackers to cause a denial of     service (application crash) or possibly execute     arbitrary code via a crafted string ending in a '%'     (percent) character. (CVE-2013-2174)

  - cURL and libcurl 7.18.0 through 7.32.0, when built with     OpenSSL, disables the certificate CN and SAN name field     verification (CURLOPT_SSL_VERIFYHOST) when the digital     signature verification (CURLOPT_SSL_VERIFYPEER) is     disabled, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid certificate.
    (CVE-2013-4545)

  - cURL and libcurl 7.10.6 through 7.34.0, when more than     one authentication method is enabled, re-uses NTLM     connections, which might allow context-dependent     attackers to authenticate as other users via a request.
    (CVE-2014-0015)

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities:

  - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is     enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary     requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3)     execute arbitrary commands via a redirect to an scp: URL. (CVE-2009-0037)

  - The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl     and other products, always performs credential delegation during GSSAPI authentication, which allows     remote servers to impersonate clients via GSSAPI requests. (CVE-2011-2192)

  - curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a     pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as     demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol. (CVE-2012-0036)

  - Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl     and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in     the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message. (CVE-2013-0249)

  - The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path     domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the     domain of a URL. (CVE-2013-1944)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2013-506:03 advisory.

    cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using     any of the supported protocols. cURL is designed to work without user interaction or any kind of     interactivity. cURL offers many useful capabilities, like proxy support, user authentication, FTP upload,     HTTP post, and file transfer resume.
    Security issues fixed with this release:
     CVE-2013-2174     No description available at the time of writing, please check the CVE link below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0983 advisory.

    [7.19.7-37]
    - fix heap-based buffer overflow in curl_easy_unescape() (CVE-2013-2174)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201401-14 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user or automated process to connect to       a malicious server using cURL, possibly resulting in the remote execution       of arbitrary code or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1393 advisory.

    This advisory aggregates security fixes for the haproxy SRPM in CIQ LTS 9.6. It addresses 17 CVEs:
    CVE-2023-45539, CVE-2025-32464, CVE-2023-40225, CVE-2023-0836, CVE-2023-0056, and 12 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
289977	MiracleLinux 3 : curl-7.15.5-17.AXS3 (AXSA:2013-534:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
66982	Scientific Linux Security Update : curl on SL5.x, SL6.x i386/srpm/x86_64 (20130625)	Nessus	Scientific Linux Local Security Checks	2013/6/26	2021/1/14	medium
67138	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : curl vulnerability (USN-1894-1)	Nessus	Ubuntu Local Security Checks	2013/7/3	2019/9/19	medium
67313	Fedora 18 : curl-7.27.0-11.fc18 (2013-11574)	Nessus	Fedora Local Security Checks	2013/7/12	2021/1/11	medium
80662	Oracle Solaris Third-Party Patch Update : libcurl (cve_2013_1944_information_disclosure)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
206854	NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/10	critical
291482	MiracleLinux 4 : curl-7.19.7-37.AXS4 (AXSA:2013-506:03)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	critical
68841	Oracle Linux 5 / 6 : curl (ELSA-2013-0983)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical
68998	Fedora 17 : curl-7.24.0-10.fc17 (2013-11568)	Nessus	Fedora Local Security Checks	2013/7/23	2021/1/11	medium
72053	GLSA-201401-14 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2014/1/21	2021/1/6	high
356264	Rocky Linux 9.6 [CIQ] Security Update: haproxy Multiple Vulnerabilities (ciqsa-2026_1393)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical

偵測

搜尋 Plugin

critical

medium

medium

medium

medium

critical

critical

critical

medium

high

critical