Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 12.04 ESM: USN-3498-2 Critical: Curl Denial Of Service

ubuntu
Calendar Grey December 4, 2017
Scroller Ubuntu
Mitigating a curl security flaw present in Ubuntu, which may trigger a client crash due to specially designed input, resulting in service disruption.
curl could be made to crash if it received specially crafted input.

Summary

curl could be made to crash if it received specially crafted

input.

Software Description:

- curl: HTTP, HTTPS, and FTP client and client libraries

Details:

USN-3498-1 fixed a vulnerability in curl. This update provides

the corresponding update for Ubuntu 12.04 ESM.

Original advisory details:

 It was discovered that curl incorrectly handled FTP wildcard matching.

 A remote attacker could use this issue to cause curl to crash,

 resulting in a denial of service, or possibly obtain sensitive

 information. (CVE-2017-8817)

Topics%20covered

Topics Covered

security advisory denial of service critical ubuntu curl

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 ESM:
  curl                            7.22.0-3ubuntu4.19
  libcurl3                        7.22.0-3ubuntu4.19
  libcurl3-gnutls                 7.22.0-3ubuntu4.19
  libcurl3-nss                    7.22.0-3ubuntu4.19

In general, a standard system update will make all the necessary
changes.

References

  https://ubuntu.com/security/notices/USN-3498-2

 

  CVE-2017-8817

Severity
critical
Lowest
Low
Medium
High
Critical

December 04, 2017

Topics%20covered

Topics Covered

security advisory denial of service critical ubuntu curl

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.