- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 202212-01
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                           https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: High
    Title: curl: Multiple Vulnerabilities
     Date: December 19, 2022
     Bugs: #803308, #813270, #841302, #843824, #854708, #867679, #878365
       ID: 202212-01

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======
Multiple vulnerabilities have been found in curl, the worst of which
could result in arbitrary code execution.

Background
=========
A command line tool and library for transferring data with URLs.

Affected packages
================
    -------------------------------------------------------------------
     Package              /     Vulnerable     /            Unaffected
    -------------------------------------------------------------------
  1  net-misc/curl              < 7.86.0                    >= 7.86.0

Description
==========
Multiple vulnerabilities have been discovered in curl. Please review the
CVE identifiers referenced below for details.

Impact
=====
Please review the referenced CVE identifiers for details.

Workaround
=========
There is no known workaround at this time.

Resolution
=========
All curl users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=net-misc/curl-7.86.0"

References
=========
[ 1 ] CVE-2021-22922
      https://nvd.nist.gov/vuln/detail/CVE-2021-22922
[ 2 ] CVE-2021-22923
      https://nvd.nist.gov/vuln/detail/CVE-2021-22923
[ 3 ] CVE-2021-22925
      https://nvd.nist.gov/vuln/detail/CVE-2021-22925
[ 4 ] CVE-2021-22926
      https://nvd.nist.gov/vuln/detail/CVE-2021-22926
[ 5 ] CVE-2021-22945
      https://nvd.nist.gov/vuln/detail/CVE-2021-22945
[ 6 ] CVE-2021-22946
      https://nvd.nist.gov/vuln/detail/CVE-2021-22946
[ 7 ] CVE-2021-22947
      https://nvd.nist.gov/vuln/detail/CVE-2021-22947
[ 8 ] CVE-2022-22576
      https://nvd.nist.gov/vuln/detail/CVE-2022-22576
[ 9 ] CVE-2022-27774
      https://nvd.nist.gov/vuln/detail/CVE-2022-27774
[ 10 ] CVE-2022-27775
      https://nvd.nist.gov/vuln/detail/CVE-2022-27775
[ 11 ] CVE-2022-27776
      https://nvd.nist.gov/vuln/detail/CVE-2022-27776
[ 12 ] CVE-2022-27779
      https://nvd.nist.gov/vuln/detail/CVE-2022-27779
[ 13 ] CVE-2022-27780
      https://nvd.nist.gov/vuln/detail/CVE-2022-27780
[ 14 ] CVE-2022-27781
      https://nvd.nist.gov/vuln/detail/CVE-2022-27781
[ 15 ] CVE-2022-27782
      https://nvd.nist.gov/vuln/detail/CVE-2022-27782
[ 16 ] CVE-2022-30115
      https://nvd.nist.gov/vuln/detail/CVE-2022-30115
[ 17 ] CVE-2022-32205
      https://nvd.nist.gov/vuln/detail/CVE-2022-32205
[ 18 ] CVE-2022-32206
      https://nvd.nist.gov/vuln/detail/CVE-2022-32206
[ 19 ] CVE-2022-32207
      https://nvd.nist.gov/vuln/detail/CVE-2022-32207
[ 20 ] CVE-2022-32208
      https://nvd.nist.gov/vuln/detail/CVE-2022-32208
[ 21 ] CVE-2022-32221
      https://nvd.nist.gov/vuln/detail/CVE-2022-32221
[ 22 ] CVE-2022-35252
      https://nvd.nist.gov/vuln/detail/CVE-2022-35252
[ 23 ] CVE-2022-35260
      https://nvd.nist.gov/vuln/detail/CVE-2022-35260
[ 24 ] CVE-2022-42915
      https://nvd.nist.gov/vuln/detail/CVE-2022-42915
[ 25 ] CVE-2022-42916
      https://nvd.nist.gov/vuln/detail/CVE-2022-42916

Availability
===========
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202212-01

Concerns?
========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
======
Copyright 2022 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5/

Gentoo: GLSA-202212-01: curl: Multiple Vulnerabilities

Multiple vulnerabilities have been found in curl, the worst of which could result in arbitrary code execution.

Summary

Multiple vulnerabilities have been discovered in curl. Please review the CVE identifiers referenced below for details.

Resolution

All curl users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.86.0"

References

[ 1 ] CVE-2021-22922 https://nvd.nist.gov/vuln/detail/CVE-2021-22922 [ 2 ] CVE-2021-22923 https://nvd.nist.gov/vuln/detail/CVE-2021-22923 [ 3 ] CVE-2021-22925 https://nvd.nist.gov/vuln/detail/CVE-2021-22925 [ 4 ] CVE-2021-22926 https://nvd.nist.gov/vuln/detail/CVE-2021-22926 [ 5 ] CVE-2021-22945 https://nvd.nist.gov/vuln/detail/CVE-2021-22945 [ 6 ] CVE-2021-22946 https://nvd.nist.gov/vuln/detail/CVE-2021-22946 [ 7 ] CVE-2021-22947 https://nvd.nist.gov/vuln/detail/CVE-2021-22947 [ 8 ] CVE-2022-22576 https://nvd.nist.gov/vuln/detail/CVE-2022-22576 [ 9 ] CVE-2022-27774 https://nvd.nist.gov/vuln/detail/CVE-2022-27774 [ 10 ] CVE-2022-27775 https://nvd.nist.gov/vuln/detail/CVE-2022-27775 [ 11 ] CVE-2022-27776 https://nvd.nist.gov/vuln/detail/CVE-2022-27776 [ 12 ] CVE-2022-27779 https://nvd.nist.gov/vuln/detail/CVE-2022-27779 [ 13 ] CVE-2022-27780 https://nvd.nist.gov/vuln/detail/CVE-2022-27780 [ 14 ] CVE-2022-27781 https://nvd.nist.gov/vuln/detail/CVE-2022-27781 [ 15 ] CVE-2022-27782 https://nvd.nist.gov/vuln/detail/CVE-2022-27782 [ 16 ] CVE-2022-30115 https://nvd.nist.gov/vuln/detail/CVE-2022-30115 [ 17 ] CVE-2022-32205 https://nvd.nist.gov/vuln/detail/CVE-2022-32205 [ 18 ] CVE-2022-32206 https://nvd.nist.gov/vuln/detail/CVE-2022-32206 [ 19 ] CVE-2022-32207 https://nvd.nist.gov/vuln/detail/CVE-2022-32207 [ 20 ] CVE-2022-32208 https://nvd.nist.gov/vuln/detail/CVE-2022-32208 [ 21 ] CVE-2022-32221 https://nvd.nist.gov/vuln/detail/CVE-2022-32221 [ 22 ] CVE-2022-35252 https://nvd.nist.gov/vuln/detail/CVE-2022-35252 [ 23 ] CVE-2022-35260 https://nvd.nist.gov/vuln/detail/CVE-2022-35260 [ 24 ] CVE-2022-42915 https://nvd.nist.gov/vuln/detail/CVE-2022-42915 [ 25 ] CVE-2022-42916 https://nvd.nist.gov/vuln/detail/CVE-2022-42916

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202212-01

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity
Severity: High
Title: curl: Multiple Vulnerabilities
Date: December 19, 2022
Bugs: #803308, #813270, #841302, #843824, #854708, #867679, #878365
ID: 202212-01

Synopsis

Multiple vulnerabilities have been found in curl, the worst of which could result in arbitrary code execution.

Background

A command line tool and library for transferring data with URLs.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/curl < 7.86.0 >= 7.86.0

Impact

===== Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Related News

23.Tablet Connections Esm H320
2 - 3 min read
The release of Ubuntu 24.04 LTS , also known as Noble Numbat, brings various security enhancements and exciting new features . These improvements
4.Lock AbstractDigital Esm H320
2 - 3 min read
Tails 6.2 is a new Linux distribution release that expands its multilingual support and improves security features. The distribution is a
19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved