moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-12-22 16:18:48 -05:00
Code Issues Releases Wiki Activity
15,831 Commits 10 Branches 144 Tags 113 MiB
C 66.7%
Python 12.4%
M4 6.9%
Perl 6.7%
DIGITAL Command Language 2.9%
Other 4.3%
f206d6c055
Go to file
Eldar Zaitov f206d6c055 Curl_sasl_create_digest_md5_message: fix buffer overflow 
When negotiating SASL DIGEST-MD5 authentication, the function
Curl_sasl_create_digest_md5_message() uses the data provided from the
server without doing the proper length checks and that data is then
appended to a local fixed-size buffer on the stack.

This vulnerability can be exploited by someone who is in control of a
server that a libcurl based program is accessing with POP3, SMTP or
IMAP. For applications that accept user provided URLs, it is also
thinkable that a malicious user would feed an application with a URL to
a server hosting code targetting this flaw.

Bug: http://curl.haxx.se/docs/adv_20130206.html
2013-02-06 11:06:33 +01:00
CMake cmake: use standard findxxx modules for cmake v2.8+ 2012-09-17 23:22:09 +02:00
docs FEATURES: Removed erroneous whitespace 2013-02-06 09:29:50 +00:00
include updated copyright years. 2013-02-04 04:50:31 +01:00
lib Curl_sasl_create_digest_md5_message: fix buffer overflow 2013-02-06 11:06:33 +01:00
m4 zz40-xc-ovr.m4: fix 'wc' detection - follow-up 2 2013-01-30 16:57:43 +01:00
packages VMS: fix and generate the VMS build config 2013-02-05 23:08:57 +01:00
perl removed trailing whitespace 2011-12-30 03:36:18 +01:00
src vms_show: post VMS patch cleanup - II 2013-02-06 04:51:55 +01:00
tests CURLMOPT_MAXCONNECTS: restore functionality 2013-02-05 09:17:52 +01:00
winbuild winbuild: include version info for .dll .exe 2013-02-05 00:08:50 +01:00
.gitattributes Tell git to not convert configure-related files. 2012-07-17 20:35:23 +02:00
.gitignore Moved some patterns to subfolder's .gitignore. 2012-07-03 14:31:50 +02:00
acinclude.m4 configure: fix cross pkg-config detection 2012-12-08 22:10:02 +01:00
Android.mk Updated build docs w.r.t. Android and binary sizes 2012-09-03 22:41:03 +02:00
buildconf Revert changes relative to lib/*.[ch] recent renaming 2013-01-06 18:20:27 +01:00
buildconf.bat curl tool: renaming hugehelp files to tool_hugehelp 2012-12-26 23:30:54 +01:00
CHANGES CHANGES: move all contents from CHANGES to CHANGES.0 2010-06-21 22:27:39 +02:00
CHANGES.0 removed trailing whitespace 2011-12-30 03:36:18 +01:00
CMakeLists.txt cmake: Fix mingw build 2013-02-04 22:35:09 +01:00
configure.ac configure: update the copyright years for the output. 2013-02-04 04:47:26 +01:00
COPYING COPYING: Updated copyright year to include 2013 2013-02-05 23:05:50 +00:00
CTestConfig.cmake ENH: move dashboard location 2009-07-15 19:40:46 +00:00
curl-config.in build: prevent global LIBS from influencing src and lib build targets 2012-12-03 22:41:18 +01:00
curl-style.el remove the CVSish $Id$ lines 2010-03-24 11:02:54 +01:00
GIT-INFO curl tool: renaming hugehelp files to tool_hugehelp 2012-12-26 23:30:54 +01:00
install-sh removed trailing whitespace 2010-02-14 19:40:18 +00:00
libcurl.pc.in build: prevent global LIBS from influencing src and lib build targets 2012-12-03 22:41:18 +01:00
log2changes.pl log2changes.pl: fix the Version output 2012-06-07 23:50:00 +02:00
MacOSX-Framework MacOSX-Framework: updates for Snowleopard 2010-09-21 00:07:45 +02:00
Makefile.am test: offer "automake" output and check for perl better 2012-11-23 11:56:26 +01:00
Makefile.dist Changed some main makefile targets. 2011-09-25 17:43:50 +02:00
Makefile.msvc.names build: refactoring of msvc makefiles to allow overriding of library filenames. 2010-12-20 21:53:44 +01:00
maketgz curl tool: use configuration files from lib directory 2012-04-06 23:37:05 +02:00
missing renamed generated config.h to curl_config.h in order to avoid clashes when libcurl is used with other projects which also have a config.h. 2009-07-14 13:25:14 +00:00
mkinstalldirs remove the CVSish $Id$ lines 2010-03-24 11:02:54 +01:00
README various changes of CVS to git 2010-03-22 00:34:09 +01:00
RELEASE-NOTES RELEASE-NOTES: synced with 25f351424b 2013-02-05 23:19:19 +01:00
sample.emacs remove the CVSish $Id$ lines 2010-03-24 11:02:54 +01:00
TODO-RELEASE TODO-RELEASE: cleanup for 7.28.0 2012-10-09 00:34:16 +02:00
vc6curl.dsw Renamed vc6 workspace and project files to avoid filename clash when used for conversion to later VS versions. 2009-05-08 17:51:44 +00:00

README 

                                  _   _ ____  _
                              ___| | | |  _ \| |
                             / __| | | | |_) | |
                            | (__| |_| |  _ <| |___
                             \___|\___/|_| \_\_____|

README

  Curl is a command line tool for transferring data specified with URL
  syntax. Find out how to use curl by reading the curl.1 man page or the
  MANUAL document. Find out how to install Curl by reading the INSTALL
  document.

  libcurl is the library curl is using to do its job. It is readily
  available to be used by your software. Read the libcurl.3 man page to
  learn how!

  You find answers to the most frequent questions we get in the FAQ document.

  Study the COPYING file for distribution terms and similar. If you distribute
  curl binaries or other binaries that involve libcurl, you might enjoy the
  LICENSE-MIXING document.

CONTACT

  If you have problems, questions, ideas or suggestions, please contact us
  by posting to a suitable mailing list. See http://curl.haxx.se/mail/

  All contributors to the project are listed in the THANKS document.

WEB SITE

  Visit the curl web site for the latest news and downloads:

        http://curl.haxx.se/

GIT

  To download the very latest source off the GIT server do this:

    git clone git://github.com/bagder/curl.git

  (you'll get a directory named curl created, filled with the source code)

NOTICE

  Curl contains pieces of source code that is Copyright (c) 1998, 1999
  Kungliga Tekniska Högskolan. This notice is included here to comply with the
  distribution terms.