Fedora 20: curl Security Update
Summary
curl is a command line tool for transferring data with URL syntax, supporting
FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP,
SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP
uploading, HTTP form based upload, proxies, cookies, user+password
authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer
resume, proxy tunneling and a busload of other useful tricks.
Update Information:
- require credentials to match for NTLM re-use (CVE-2015-3143) - fix invalid write in cookie path sanitization code (CVE-2015-3145) - close Negotiate connections when done (CVE-2015-3148)
Change Log
* Wed Apr 22 2015 Kamil Dudka
References
[ 1 ] Bug #1213351 - CVE-2015-3148 curl: Negotiate not treated as connection-oriented https://bugzilla.redhat.com/show_bug.cgi?id=1213351 [ 2 ] Bug #1213306 - CVE-2015-3143 curl: re-using authenticated connection when unauthenticated https://bugzilla.redhat.com/show_bug.cgi?id=1213306 [ 3 ] Bug #1213347 - CVE-2015-3145 curl: cookie parser out of boundary memory access https://bugzilla.redhat.com/show_bug.cgi?id=1213347
Update Instructions
This update can be installed with the "yum" update program. Use su -c 'yum update curl' at the command line. For more information, refer to "Managing Software with yum", available at .