drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in curl
Name: |
Mehrere Probleme in curl |
|
ID: |
DSA-3992-1 |
|
Distribution: |
Debian |
|
Plattformen: |
Debian jessie, Debian stretch |
|
Datum: |
Sa, 7. Oktober 2017, 01:24 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000101
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000254
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000100 |
|
Applikationen: |
curl |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
- ------------------------------------------------------------------------- Debian Security Advisory DSA-3992-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso October 06, 2017 https://www.debian.org/security/faq - -------------------------------------------------------------------------
Package : curl CVE ID : CVE-2017-1000100 CVE-2017-1000101 CVE-2017-1000254 Debian Bug : 871554 871555 877671
Several vulnerabilities have been discovered in cURL, an URL transfer library. The Common Vulnerabilities and Exposures project identifies the following problems:
CVE-2017-1000100
Even Rouault reported that cURL does not properly handle long file names when doing an TFTP upload. A malicious HTTP(S) server can take advantage of this flaw by redirecting a client using the cURL library to a crafted TFTP URL and trick it to send private memory contents to a remote server over UDP.
CVE-2017-1000101
Brian Carpenter and Yongji Ouyang reported that cURL contains a flaw in the globbing function that parses the numerical range, leading to an out-of-bounds read when parsing a specially crafted URL.
CVE-2017-1000254
Max Dymond reported that cURL contains an out-of-bounds read flaw in the FTP PWD response parser. A malicious server can take advantage of this flaw to effectively prevent a client using the cURL library to work with it, causing a denial of service.
For the oldstable distribution (jessie), these problems have been fixed in version 7.38.0-4+deb8u6.
For the stable distribution (stretch), these problems have been fixed in version 7.52.1-5+deb9u1.
We recommend that you upgrade your curl packages.
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlnX6SFfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0RbAQ/9Gft7QL7XZ1eqos8uYgcysihp44zzwjlbpRs3RXIH7Z++HiGvz79Zpipw fI48mLAeI9q3hLk/RuPFV4VDGwtbbMFF4+swlzQXCSg0aWKG4qdEaxP2cLMCJkb/ hv9d/jvcJIEwxiwcmkE8JQI1Fbwql7HoFzE86iWS5/2iU2KHtmhWMCa4V1cudu0o 4Sc7JfnD6wkyhb6KYqarHQXpp9qtfu84I5ununYKQ5WXHKWxYSRqAgIBPOui7kzk TdLFYp+ZQw2cdI5T400fCyPOtpO76ngL9BjztiCHsUDK6SFOR3x0J8FII/NAPn6z cct1k6iOaLTTCLp1FLqwml02SWSpyoytDRhBjyr4bQh/P2OYOoCsy2/Ns9vNnUFh p3babYWQu+Hn2YIa3zu/yBdBrAslUgT7gjPX0vfr9zrY3PJwIvy2L2oe8pUB4bfu ovqFIrgK18Vi9KRu51n/3CFnPNOtO6RAUG5hWxSMsUwv5g00rbRNJD7WhJx1v7Xy WzyqthBTDOzMNtzr9fGQjR8GSn/FZw1qvTbfQmfNOzXYMmY0gMY/RWk8PJouISWG DFERQD45+KQnir/eOjldQ0K+oVpb3poBsUXeEYkY76cRlD/XAAfGjJXrlYFi8uIS vmmqbdbU18yX5Dbx9kx3GgQdju6ueN7H4JxQrQk4kd+DP8AhraI= =MtOm -----END PGP SIGNATURE-----
|
|
|
|