Ubuntu 19.04 USN-3993-1 Critical: Curl Denial of Service Issues

ubuntu

May 22, 2019

Several security issues were fixed in curl.

Summary

Several security issues were fixed in curl.

Software Description:

- curl: HTTP, HTTPS, and FTP client and client libraries

Details:

Wenchao Li discovered that curl incorrectly handled memory in the

curl_url_set() function. A remote attacker could use this issue to cause

curl to crash, resulting in a denial of service, or possibly execute

arbitrary code. This issue only affected Ubuntu 19.04. (CVE-2019-5435)

It was discovered that curl incorrectly handled memory when receiving data

from a TFTP server. A remote attacker could use this issue to cause curl to

crash, resulting in a denial of service, or possibly execute arbitrary

code. (CVE-2019-5436)

Topics Covered

security advisory denial of service software update memory issue ubuntu curl network client

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
  curl                            7.64.0-2ubuntu1.1
  libcurl3-gnutls                 7.64.0-2ubuntu1.1
  libcurl3-nss                    7.64.0-2ubuntu1.1
  libcurl4                        7.64.0-2ubuntu1.1

Ubuntu 18.10:
  curl                            7.61.0-1ubuntu2.4
  libcurl3-gnutls                 7.61.0-1ubuntu2.4
  libcurl3-nss                    7.61.0-1ubuntu2.4
  libcurl4                        7.61.0-1ubuntu2.4

Ubuntu 18.04 LTS:
  curl                            7.58.0-2ubuntu3.7
  libcurl3-gnutls                 7.58.0-2ubuntu3.7
  libcurl3-nss                    7.58.0-2ubuntu3.7
  libcurl4                        7.58.0-2ubuntu3.7

Ubuntu 16.04 LTS:
  curl                            7.47.0-1ubuntu2.13
  libcurl3                        7.47.0-1ubuntu2.13
  libcurl3-gnutls                 7.47.0-1ubuntu2.13
  libcurl3-nss                    7.47.0-1ubuntu2.13

In general, a standard system update will make all the necessary changes.