Mailinglist Archive: opensuse-updates (101 mails)

< Previous Next >
openSUSE-SU-2015:0248-1: moderate: Security update for curl
openSUSE Security Update: Security update for curl
______________________________________________________________________________

Announcement ID: openSUSE-SU-2015:0248-1
Rating: moderate
References: #901924 #911363
Cross-References: CVE-2014-3707 CVE-2014-8150
Affected Products:
openSUSE 13.2
openSUSE 13.1
______________________________________________________________________________

An update that fixes two vulnerabilities is now available.

Description:

was updated to version 7.40.0 to fix two security issues.

These security issues were fixed:
- CVE-2014-8150: CRLF injection vulnerability in libcurl 6.0 through 7.x
before 7.40.0, when using an HTTP proxy, allowed remote attackers to
inject arbitrary HTTP headers and conduct HTTP response splitting
attacks via CRLF sequences in a URL (bnc#911363).
- CVE-2014-3707: The curl_easy_duphandle function in libcurl 7.17.1
through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, did
not properly copy HTTP POST data for an easy handle, which triggered an
out-of-bounds read that allowed remote web servers to read sensitive
memory information (bnc#901924).

These non-security issues were fixed:
- http_digest: Added support for Windows SSPI based authentication
- version info: Added Kerberos V5 to the supported features
- Makefile: Added VC targets for WinIDN
- SSL: Add PEM format support for public key pinning
- smtp: Added support for the conversion of Unix newlines during mail send
- smb: Added initial support for the SMB/CIFS protocol
- Added support for HTTP over unix domain sockets,
- via CURLOPT_UNIX_SOCKET_PATH and --unix-socket
- sasl: Added support for GSS-API based Kerberos V5 authentication


Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- openSUSE 13.2:

zypper in -t patch openSUSE-2015-125=1

- openSUSE 13.1:

zypper in -t patch openSUSE-2015-125=1

To bring your system up-to-date, use "zypper patch".


Package List:

- openSUSE 13.2 (i586 x86_64):

curl-7.40.0-4.1
curl-debuginfo-7.40.0-4.1
curl-debugsource-7.40.0-4.1
libcurl-devel-7.40.0-4.1
libcurl4-7.40.0-4.1
libcurl4-debuginfo-7.40.0-4.1

- openSUSE 13.2 (x86_64):

libcurl4-32bit-7.40.0-4.1
libcurl4-debuginfo-32bit-7.40.0-4.1

- openSUSE 13.1 (i586 x86_64):

curl-7.40.0-2.35.1
curl-debuginfo-7.40.0-2.35.1
curl-debugsource-7.40.0-2.35.1
libcurl-devel-7.40.0-2.35.1
libcurl4-7.40.0-2.35.1
libcurl4-debuginfo-7.40.0-2.35.1

- openSUSE 13.1 (x86_64):

libcurl4-32bit-7.40.0-2.35.1
libcurl4-debuginfo-32bit-7.40.0-2.35.1


References:

http://support.novell.com/security/cve/CVE-2014-3707.html
http://support.novell.com/security/cve/CVE-2014-8150.html
https://bugzilla.suse.com/show_bug.cgi?id=901924
https://bugzilla.suse.com/show_bug.cgi?id=911363


< Previous Next >
This Thread
  • No further messages