Stay Secure with the Latest Linux Advisories

security advisorycriticalpackage update

Slackware: SSA:2022-299-01 Critical Curl Flaws Threat Level High

New curl packages are available for Slackware 14.0, 14.1, 14.2, 15.0, and -current to fix security issues. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] curl (SSA:2022-299-01) New curl packages are available for Slackware 14.0, 14.1, 14.2, 15.0, and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: +--------------------------+ patches/packages/curl-7.86.0-i586-1_slack15.0.txz: Upgraded. This update fixes security issues: HSTS bypass via IDN. HTTP proxy double-free. .netrc parser out-of-bounds access. POST following PUT confusion. For more information, see: https://curl.se/docs/CVE-2022-42916.html https://curl.se/docs/CVE-2022-42915.html https://curl.se/docs/CVE-2022-35260.html https://curl.se/docs/CVE-2022-32221.html https://www.cve.org/CVERecord?id=CVE-2022-42916 https://www.cve.org/CVERecord?id=CVE-2022-42915 https://www.cve.org/CVERecord?id=CVE-2022-35260 https://www.cve.org/CVERecord?id=CVE-2022-32221 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated package for Slackware 14.0: Updated package for Slackware x86_64 14.0: Updated package for Slackware 14.1: Updated package for Slackware x86_64 14.1: Updated package for Slackware 14.2: Updated package for Slackware x86_64 14.2: Updated package for Slackware 15.0: Updated package for Slackware x86_64 15.0: Updated package for Slackware -current: Updated package for Slackware x86_64 -current: MD5 signatures: +-------------+ Slackware 14.0 package: b78e6b863ecfe4c828418b7bea7d32ba curl-7.86.0-i486-1_slack14.0.txz Slackware x86_64 14.0 package: cd60d8c19059b6bb4a515e5b767d0837 curl-7.86.0-x86_64-1_slack14.0.txz Slackware14.1 package: 95c6ececc2da90b5dc1e45805589d064 curl-7.86.0-i486-1_slack14.1.txz Slackware x86_64 14.1 package: 8991f1f356f2808c1f3abf0b2156b29c curl-7.86.0-x86_64-1_slack14.1.txz Slackware 14.2 package: 2807e70b0c276b8c7347ba3442516cdd curl-7.86.0-i586-1_slack14.2.txz Slackware x86_64 14.2 package: a7ff71eb8f11b06c94920e4249fdbc9f curl-7.86.0-x86_64-1_slack14.2.txz Slackware 15.0 package: b18ac9d2f04779d85e4b8074215bc4de curl-7.86.0-i586-1_slack15.0.txz Slackware x86_64 15.0 package: d964e55efac23cf53e784753c901da11 curl-7.86.0-x86_64-1_slack15.0.txz Slackware -current package: 459eae0cdc0f8e9eb235e936115221c6 n/curl-7.86.0-i586-1.txz Slackware x86_64 -current package: 4bdb1f1445a330ab94033a9a97e4e56e n/curl-7.86.0-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg curl-7.86.0-i586-1_slack15.0.txz +-----+ . Updated curl binaries for Slackware versions 14.0 through 15.0 tackle significant vulnerabilities, featuring corrections for HSTS bypass and additional concerns.. Curl Package Update, Slackware Security Fixes, Critical Flaws. . Severity: Critical. LinuxSecurity.com Team

Oct 26, 2022 •Critical Slackware