Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 615
Alerts This Week
Warning Icon 1 615

Ubuntu: 4129-1 Critical: curl Denial Of Service from Memory Issues

ubuntu
Calendar Grey September 11, 2019
Dist Ubuntu Esm H88
Multiple weaknesses identified in curl addressed by the Ubuntu Security Notice USN-4129-1. Upgrade now to safeguard your system.
Several security issues were fixed in curl.

Summary

Several security issues were fixed in curl.

Software Description:

- curl: HTTP, HTTPS, and FTP client and client libraries

Details:

Thomas Vegas discovered that curl incorrectly handled memory when using

Kerberos over FTP. A remote attacker could use this issue to crash curl,

resulting in a denial of service. (CVE-2019-5481)

Thomas Vegas discovered that curl incorrectly handled memory during TFTP

transfers. A remote attacker could use this issue to crash curl, resulting

in a denial of service, or possibly execute arbitrary code. (CVE-2019-5482)

Topics%20covered

Topics Covered

security advisory denial of service remote attack ubuntu curl memory handling

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
  curl                            7.64.0-2ubuntu1.2
  libcurl3-gnutls                 7.64.0-2ubuntu1.2
  libcurl3-nss                    7.64.0-2ubuntu1.2
  libcurl4                        7.64.0-2ubuntu1.2

Ubuntu 18.04 LTS:
  curl                            7.58.0-2ubuntu3.8
  libcurl3-gnutls                 7.58.0-2ubuntu3.8
  libcurl3-nss                    7.58.0-2ubuntu3.8
  libcurl4                        7.58.0-2ubuntu3.8

Ubuntu 16.04 LTS:
  curl                            7.47.0-1ubuntu2.14
  libcurl3                        7.47.0-1ubuntu2.14
  libcurl3-gnutls                 7.47.0-1ubuntu2.14
  libcurl3-nss                    7.47.0-1ubuntu2.14

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4129-1

CVE-2019-5481, CVE-2019-5482

Severity
critical
Lowest
Low
Medium
High
Critical

September 11, 2019

Topics%20covered

Topics Covered

security advisory denial of service remote attack ubuntu curl memory handling

Package Information

https://launchpad.net/ubuntu/+source/curl/7.64.0-2ubuntu1.2
https://launchpad.net/ubuntu/+source/curl/7.58.0-2ubuntu3.8
https://launchpad.net/ubuntu/+source/curl/7.47.0-1ubuntu2.14

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.