ESB-2018.3443 - [Debian] curl: Multiple vulnerabilities 2018-11-05

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.3443
                           curl security update
                              5 November 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           curl
Publisher:         Debian
Operating System:  Debian GNU/Linux 9
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Denial of Service               -- Remote with User Interaction
                   Access Confidential Data        -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-16842 CVE-2018-16839 

Reference:         ESB-2018.3423.2

Original Bulletin: 
   http://www.debian.org/security/2018/dsa-4331

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4331-1                   security@debian.org
https://www.debian.org/security/                       Alessandro Ghedini
November 02, 2018                     https://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : curl
CVE ID         : CVE-2018-16839 CVE-2018-16842

Two vulnerabilities were discovered in cURL, an URL transfer library.

CVE-2018-16839

    Harry Sintonen discovered that, on systems with a 32 bit size_t, an
    integer overflow would be triggered when a SASL user name longer
    than 2GB is used. This would in turn cause a very small buffer to be
    allocated instead of the intended very huge one, which would trigger
    a heap buffer overflow when the buffer is used.

CVE-2018-16842

    Brian Carpenter discovered that the logic in the curl tool to wrap
    error messages at 80 columns is flawed, leading to a read buffer
    overflow if a single word in the message is itself longer than 80
    bytes.

For the stable distribution (stretch), these problems have been fixed in
version 7.52.1-5+deb9u8.

We recommend that you upgrade your curl packages.

For the detailed security status of curl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/curl

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEBsId305pBx+F583DbwzL4CFiRygFAlvcr1kACgkQbwzL4CFi
Rygs+BAAmcWJ0has/E0MhZVOJfgylJNN7L31TlPO5+/1i5pltPdxk84VFq3qho1E
Be/5TVETGBzkgfR3qPv1/4eJpvuNe47/Q1KoQY6Nauh6i/lT3BCR9Sv/OBJXmIj/
b/dWhEd8VYSjCj1s/e0Cr/rT/NRxj+awqP+QzvQkPosjPRDfRbhJ+zauRWWLFjri
l2TyaI+WSaxGWyhrC7SXbEbDF+dAcvAGxwrZM36JdFrmV7oTiMvmLOuXLypHNIt5
18rwDMOUAMd4CGePQrEDPqQ1LNC29hFgjhBhp2JSPzF5LOtX1HFAfwpnOOeqR/MS
wbd1D8c4dW82z9+0BRmWfZKXn9NfSdHpVEYbNSoa81qy1TN2yZXokCgg7ueb5saN
0tQnS9FiJH8NHVSlw/gp83B4qczRv6cvxjrasXb9uoEFcFf8DcOe7zLL214gHraL
x7dHhjh9ki9me8W4qRocDFWTY9Ho4UekdgBkCLOXnAq+je9MqtG9gHT5MTXr8MsY
foDu6kok2jMYOKKmUv+fHUgEufwqFg1JAQcd4FVy6/MiInhagR/PEH0zwUR/ZKN8
6R+dgk/+gAFz/gSggUOej2VHw3yOfPJHD0hRkr5Hn47mucN2FStJ8r0kqyonskwp
eGgTqLnwrvJZ/61LmHFzFIZxZXGLb+3QZCEAvEGTBg8Vf9EvhsE=
=ROKd
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBW9+HCmaOgq3Tt24GAQiqUhAAw63i4lv9efMKBegOMkIDy47Limx4nY2W
9imSX0o0q+IGIzMS6NtN/1iavvoLxkEU0xXPWLybf5OFudmNCV+B7yvI8Z6nCwCd
o4fKd53CXGzyweBTOkFxhWXptBm4TrxjUKT0tffLt9//BXTJ6iLhRhLJ8mzJGe55
rpExfP2QAEwNQ4i02R+z8uNyRdDGd4aCJT5Hyf25cAVNU0iZ/zaJBuINtap9+SMJ
HSMpz6z6Z8f0bBxQBGUsZqA+k2KE/WJeE5LCq5du97IUO/FblAsEAnt0iNFQ2tjM
dS063x+Zl/ItSvGG+E5hAg8BrUes3WpgEXW0a8E+63EGIhNKefrg6r5G3HP/U0C6
wVOxfQ1R5O2wN8hLG8l4gG2ukYa7pnHHmsW8ztxq4jZnA4Nkvrw/pcFvXsc5qRbC
L6DGUdcPjuH3mXenk+xDOa1QhAqpbyu44yXhlTnGth4Nt949Vbv0E5istI8Qdiu0
+CTEqhN55W9P/n/wC+48F7hiZaAyotsJpgQObavDzOni5ZRJLkFbjRH54vqobAQz
DSJc1ChP1SswRBKZTN4/t2aj4gld4pfNYFoF944ffKuAoscuIPLl3z7bK8v/Qbk+
a37kQjYRavAKLK/S+fDgfYrN0IE2tGgXUdpRuBHiF1vk524cP83AZSfFwNBiel5i
w7ZOVwRksok=
=OnsF
-----END PGP SIGNATURE-----

« Back to bulletins