Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia 7: MGASA-2019-0337 Critical Curl Buffer Overflow Fix

mageia
Calendar Grey November 30, 2019
Dist Mageia Esm H88
Mageia 2019-0340 patches remedy various vulnerabilities in libpng, correcting integer overflows and possible remote exploitation.
The updated packages fix security vulnerabilities: An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1

Summary

The updated packages fix security vulnerabilities:
An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. (CVE-2019-5435)
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1 (CVE-2019-5436).
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3 (CVE-2019-5481).
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3 (CVE-2019-5482).

References

- https://bugs.mageia.org/show_bug.cgi?id=23789

- https://curl.se/changes.html

- https://curl.se/changes.html

- https://curl.se/docs/CVE-2019-5435.html

- https://curl.se/docs/CVE-2019-5436.html

- https://curl.se/docs/CVE-2019-5481.html

- https://curl.se/docs/CVE-2019-5482.html

- https://ubuntu.com/security/notices/USN-3993-1

- https://www.cve.org/CVERecord?id=CVE-2019-5435

- https://www.cve.org/CVERecord?id=CVE-2019-5436

- https://www.cve.org/CVERecord?id=CVE-2019-5481

- https://www.cve.org/CVERecord?id=CVE-2019-5482

Topics%20covered

Topics Covered

security advisory security issue buffer overflow code execution DoS curl Mageia

Resolution

SRPMS

- 7/core/curl-7.66.0-1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 30 Nov 2019
URL: https://advisories.mageia.org/MGASA-2019-0337.html
Type: security
CVE: CVE-2019-5435, CVE-2019-5436, CVE-2019-5481, CVE-2019-5482

Topics%20covered

Topics Covered

security advisory security issue buffer overflow code execution DoS curl Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here