Advisories » MGASA-2018-0054

Updated curl packages fix security vulnerability

Publication date: 03 Jan 2018
Modification date: 03 Jan 2018
Type: security
Affected Mageia releases : 6
CVE: CVE-2017-8816 , CVE-2017-8817 , CVE-2017-1000254 , CVE-2017-1000257

Description

libcurl contains a buffer overrun flaw in the NTLM authentication code
(CVE-2017-8816).

libcurl contains a read out of bounds flaw in the FTP wildcard function
(CVE-2017-8817).

libcurl may read outside of a heap allocated buffer when doing FTP
(CVE-2017-1000254).

libcurl contains a buffer overrun flaw in the IMAP handler
(CVE-2017-1000257).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=21819
• https://curl.haxx.se/docs/adv_20171004.html
• https://curl.haxx.se/docs/adv_20171023.html
• https://curl.haxx.se/docs/adv_2017-12e7.html
• https://curl.haxx.se/docs/adv_2017-ae72.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8816
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8817
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000254
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000257

SRPMS

6/core

• curl-7.54.1-2.4.mga6