Advisories » MGASA-2019-0337

Updated curl packages fix security vulnerabilities

Publication date: 30 Nov 2019
Modification date: 30 Nov 2019
Type: security
Affected Mageia releases : 7
CVE: CVE-2019-5435 , CVE-2019-5436 , CVE-2019-5481 , CVE-2019-5482

Description

The updated packages fix security vulnerabilities:

An integer overflow in curl's URL API results in a buffer overflow
in libcurl 7.62.0 to and including 7.64.1. (CVE-2019-5435)

A heap buffer overflow in the TFTP receiving code allows for DoS or
arbitrary code execution in libcurl versions 7.19.4 through 7.64.1
(CVE-2019-5436).

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to
7.65.3 (CVE-2019-5481).

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to
7.65.3 (CVE-2019-5482).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=23789
• https://curl.haxx.se/changes.html#7_65_0
• https://curl.haxx.se/changes.html#7_66_0
• https://curl.haxx.se/docs/CVE-2019-5435.html
• https://curl.haxx.se/docs/CVE-2019-5436.html
• https://curl.haxx.se/docs/CVE-2019-5481.html
• https://curl.haxx.se/docs/CVE-2019-5482.html
• https://usn.ubuntu.com/3993-1/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5435
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5436
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5482

SRPMS

7/core

• curl-7.66.0-1.mga7