UbuntuUpdates.org

Package "curl"

Name: curl

Description:

command line tool for transferring data with URL syntax

Latest version: 7.35.0-1ubuntu2.20
Release: trusty (14.04)
Level: security
Repository: main
Homepage: http://curl.haxx.se

Links


Download "curl"


Other versions of "curl" in Trusty

Repository Area Version
base main 7.35.0-1ubuntu2
updates main 7.35.0-1ubuntu2.20

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 7.35.0-1ubuntu2.20 2019-02-06 16:07:58 UTC

  curl (7.35.0-1ubuntu2.20) trusty-security; urgency=medium

  * SECURITY UPDATE: SMTP end-of-response out-of-bounds read
    - debian/patches/CVE-2019-3823.patch: avoid risk of buffer overflow in
      strtol in lib/smtp.c.
    - CVE-2019-3823

 -- Marc Deslauriers <email address hidden> Tue, 29 Jan 2019 09:03:19 -0500

Source diff to previous version
CVE-2019-3823 curl: SMTP end-of-response out-of-bounds read

Version: 7.35.0-1ubuntu2.19 2018-10-31 13:06:20 UTC

  curl (7.35.0-1ubuntu2.19) trusty-security; urgency=medium

  * SECURITY UPDATE: SASL password overflow via integer overflow
    - debian/patches/CVE-2018-16839-pre1.patch: prevent size overflows in
      lib/curl_sasl.c.
    - debian/patches/CVE-2018-16839-pre2.patch: fix integer overflow check
      in lib/curl_ntlm_core.c, lib/curl_setup.h, lib/curl_sasl.c.
    - debian/patches/CVE-2018-16839.patch: fix check in lib/curl_sasl.c.
    - CVE-2018-16839
  * SECURITY UPDATE: warning message out-of-buffer read
    - debian/patches/oob-read.patch: fix bad arithmetic in src/tool_msgs.c.
    - CVE number pending

 -- Marc Deslauriers <email address hidden> Mon, 29 Oct 2018 08:15:06 -0400

Source diff to previous version
CVE-2018-16839 SASL password overflow via integer overflow

Version: 7.35.0-1ubuntu2.17 2018-09-17 08:06:34 UTC

  curl (7.35.0-1ubuntu2.17) trusty-security; urgency=medium

  * SECURITY UPDATE: Buffer overrun
    - debian/patches/CVE-2018-14618.patch: fix in
      lib/curl_ntlm_core.c.
    - CVE-2018-14618

 -- <email address hidden> (Leonidas S. Barbosa) Wed, 12 Sep 2018 15:20:26 -0300

Source diff to previous version
CVE-2018-14618 curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multipl

Version: 7.35.0-1ubuntu2.16 2018-05-16 16:07:03 UTC

  curl (7.35.0-1ubuntu2.16) trusty-security; urgency=medium

  * SECURITY UPDATE: RTSP bad headers buffer over-read
    - debian/patches/CVE-2018-1000301.patch: restore buffer pointer when
      bad response-line is parsed in lib/http.c.
    - CVE-2018-1000301

 -- Marc Deslauriers <email address hidden> Tue, 08 May 2018 14:05:52 -0400

Source diff to previous version
CVE-2018-1000301 RTSP bad headers buffer over-read

Version: 7.35.0-1ubuntu2.15 2018-03-15 14:09:12 UTC

  curl (7.35.0-1ubuntu2.15) trusty-security; urgency=medium

  * SECURITY UPDATE: FTP path trickery leads to NIL byte OOB write
    - debian/patches/CVE-2018-1000120-pre1.patch: avoid using
      curl_easy_unescape() internally in lib/ftp.c.
    - debian/patches/CVE-2018-1000120-pre2.patch: URL decode path for dir
      listing in nocwd mode in lib/ftp.c, add test to tests/*.
    - debian/patches/CVE-2018-1000120-pre3.patch: remove dead code in
      ftp_done in lib/ftp.c.
    - debian/patches/CVE-2018-1000120-pre4.patch: don't clobber the passed
      in error code in lib/ftp.c.
    - debian/patches/CVE-2018-1000120.patch: reject path components with
      control codes in lib/ftp.c, add test to tests/*.
    - CVE-2018-1000120
  * SECURITY UPDATE: LDAP NULL pointer dereference
    - debian/patches/CVE-2018-1000121.patch: check ldap_get_attribute_ber()
      results for NULL before using in lib/openldap.c.
    - CVE-2018-1000121
  * SECURITY UPDATE: RTSP RTP buffer over-read
    - debian/patches/CVE-2018-1000122.patch: make sure excess reads don't
      go beyond buffer end in lib/transfer.c.
    - CVE-2018-1000122

 -- Marc Deslauriers <email address hidden> Wed, 14 Mar 2018 09:18:48 -0400




About   -   Send Feedback to @ubuntu_updates