A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
CVSS Score
3.7
EPSS Score
0.001
Published
2020-12-14
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
CVSS Score
9.8
EPSS Score
0.04
Published
2019-09-16
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVSS Score
9.8
EPSS Score
0.083
Published
2019-09-16
Page 5