Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.3443 curl security update 5 November 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: curl Publisher: Debian Operating System: Debian GNU/Linux 9 Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction Denial of Service -- Remote with User Interaction Access Confidential Data -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2018-16842 CVE-2018-16839 Reference: ESB-2018.3423.2 Original Bulletin: http://www.debian.org/security/2018/dsa-4331 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - - ------------------------------------------------------------------------- Debian Security Advisory DSA-4331-1 security@debian.org https://www.debian.org/security/ Alessandro Ghedini November 02, 2018 https://www.debian.org/security/faq - - ------------------------------------------------------------------------- Package : curl CVE ID : CVE-2018-16839 CVE-2018-16842 Two vulnerabilities were discovered in cURL, an URL transfer library. CVE-2018-16839 Harry Sintonen discovered that, on systems with a 32 bit size_t, an integer overflow would be triggered when a SASL user name longer than 2GB is used. This would in turn cause a very small buffer to be allocated instead of the intended very huge one, which would trigger a heap buffer overflow when the buffer is used. CVE-2018-16842 Brian Carpenter discovered that the logic in the curl tool to wrap error messages at 80 columns is flawed, leading to a read buffer overflow if a single word in the message is itself longer than 80 bytes. For the stable distribution (stretch), these problems have been fixed in version 7.52.1-5+deb9u8. We recommend that you upgrade your curl packages. For the detailed security status of curl please refer to its security tracker page at: https://security-tracker.debian.org/tracker/curl Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org - -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEBsId305pBx+F583DbwzL4CFiRygFAlvcr1kACgkQbwzL4CFi Rygs+BAAmcWJ0has/E0MhZVOJfgylJNN7L31TlPO5+/1i5pltPdxk84VFq3qho1E Be/5TVETGBzkgfR3qPv1/4eJpvuNe47/Q1KoQY6Nauh6i/lT3BCR9Sv/OBJXmIj/ b/dWhEd8VYSjCj1s/e0Cr/rT/NRxj+awqP+QzvQkPosjPRDfRbhJ+zauRWWLFjri l2TyaI+WSaxGWyhrC7SXbEbDF+dAcvAGxwrZM36JdFrmV7oTiMvmLOuXLypHNIt5 18rwDMOUAMd4CGePQrEDPqQ1LNC29hFgjhBhp2JSPzF5LOtX1HFAfwpnOOeqR/MS wbd1D8c4dW82z9+0BRmWfZKXn9NfSdHpVEYbNSoa81qy1TN2yZXokCgg7ueb5saN 0tQnS9FiJH8NHVSlw/gp83B4qczRv6cvxjrasXb9uoEFcFf8DcOe7zLL214gHraL x7dHhjh9ki9me8W4qRocDFWTY9Ho4UekdgBkCLOXnAq+je9MqtG9gHT5MTXr8MsY foDu6kok2jMYOKKmUv+fHUgEufwqFg1JAQcd4FVy6/MiInhagR/PEH0zwUR/ZKN8 6R+dgk/+gAFz/gSggUOej2VHw3yOfPJHD0hRkr5Hn47mucN2FStJ8r0kqyonskwp eGgTqLnwrvJZ/61LmHFzFIZxZXGLb+3QZCEAvEGTBg8Vf9EvhsE= =ROKd - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBW9+HCmaOgq3Tt24GAQiqUhAAw63i4lv9efMKBegOMkIDy47Limx4nY2W 9imSX0o0q+IGIzMS6NtN/1iavvoLxkEU0xXPWLybf5OFudmNCV+B7yvI8Z6nCwCd o4fKd53CXGzyweBTOkFxhWXptBm4TrxjUKT0tffLt9//BXTJ6iLhRhLJ8mzJGe55 rpExfP2QAEwNQ4i02R+z8uNyRdDGd4aCJT5Hyf25cAVNU0iZ/zaJBuINtap9+SMJ HSMpz6z6Z8f0bBxQBGUsZqA+k2KE/WJeE5LCq5du97IUO/FblAsEAnt0iNFQ2tjM dS063x+Zl/ItSvGG+E5hAg8BrUes3WpgEXW0a8E+63EGIhNKefrg6r5G3HP/U0C6 wVOxfQ1R5O2wN8hLG8l4gG2ukYa7pnHHmsW8ztxq4jZnA4Nkvrw/pcFvXsc5qRbC L6DGUdcPjuH3mXenk+xDOa1QhAqpbyu44yXhlTnGth4Nt949Vbv0E5istI8Qdiu0 +CTEqhN55W9P/n/wC+48F7hiZaAyotsJpgQObavDzOni5ZRJLkFbjRH54vqobAQz DSJc1ChP1SswRBKZTN4/t2aj4gld4pfNYFoF944ffKuAoscuIPLl3z7bK8v/Qbk+ a37kQjYRavAKLK/S+fDgfYrN0IE2tGgXUdpRuBHiF1vk524cP83AZSfFwNBiel5i w7ZOVwRksok= =OnsF -----END PGP SIGNATURE-----