Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.3498
USN-4129-2: curl vulnerability
13 September 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: curl
Publisher: Ubuntu
Operating System: Ubuntu
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2019-5482
Reference: ESB-2019.3472
ESB-2019.3441
Original Bulletin:
https://usn.ubuntu.com/4129-2/
- --------------------------BEGIN INCLUDED TEXT--------------------
USN-4129-2: curl vulnerability
12 September 2019
curl vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
o Ubuntu 14.04 ESM
o Ubuntu 12.04 ESM
Summary
curl could be made to crash or possibly execute arbitrary code if it
incorrectly handled memory during TFTP transfers.
Software Description
o curl - HTTP, HTTPS, and FTP client and client libraries
Details
USN-4129-1 fixed a vulnerability in curl. This update provides the
corresponding update for Ubuntu 12.04 ESM and 14.04 ESM.
Original advisory details:
Thomas Vegas discovered that curl incorrectly handled memory during TFTP
transfers. A remote attacker could use this issue to crash curl, resulting in a
denial of service, or possibly execute arbitrary code.
Update instructions
The problem can be corrected by updating your system to the following package
versions:
Ubuntu 14.04 ESM
curl - 7.35.0-1ubuntu2.20+esm3
libcurl3 - 7.35.0-1ubuntu2.20+esm3
libcurl3-gnutls - 7.35.0-1ubuntu2.20+esm3
libcurl3-nss - 7.35.0-1ubuntu2.20+esm3
Ubuntu 12.04 ESM
curl - 7.22.0-3ubuntu4.27
libcurl3 - 7.22.0-3ubuntu4.27
libcurl3-gnutls - 7.22.0-3ubuntu4.27
libcurl3-nss - 7.22.0-3ubuntu4.27
To update your system, please follow these instructions: https://
wiki.ubuntu.com/Security/Upgrades .
In general, a standard system update will make all the necessary changes.
References
o USN-4129-1
o CVE-2019-5482
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXXrkumaOgq3Tt24GAQjIGhAAvntpmEz9/jE15cWmr4cX0iSGCcYCsDjN
TFFoebuX7v6OnO/dPOYSvAPFtkQ/29gmEmjydsNrJ2Sd3rHYVyqaKyhkaqE8pwJR
mMYT/Z4/vPzYFI41/yzmYQrJs8OyqSCYqecfFBYR2eL2nFvjO0JubgctqXw954zz
X8CP+dhnh5gWqIyYjJtYRSqf0PgTl28cYVFHuTH/h1ORfWWFv4j/cfkxZ/lS1XnU
VrgUhx/gp2/owBmcY0SobFmpXy/K+vhPnUYx9nhbXGnvzlQnNmo40DPO5TTMpfmi
GqGLcQDHxtK+/Djv3G4sPyodIZ7uboNouzgBRnV6n8jt4yLLf9whtQnmXzsaPu18
iqF4t78zyxLcKq+CC7VOl5PHPC3/nF0mMoRpCDxLo8N3dviwQuiPFjdH92xgPznK
UaP8oRnTS4O7BAwWknNXowB/ysWKvnqJJPpYu540zkUrHdEgffZTvYfcJSG4L+L+
Nha0MO5pH+n5baR+id5wyowsof//tZSl78h5r8Ne2TMBK5SpbihNh5i8/NaM81Pe
ITbzcWYlgEHhZ+1mRlnNyyytavNtMEVVZB6JPRTuqfDbmHgPkCe4MkhhJ+Gt4akL
Hj4NS+AwQRU15A6BvLaxpeJm3kb8JTXu/cEWm+Q7Dw3u7X7g21sN4Yibl52fJnWD
9fHYoIhX6Ug=
=hpv5
-----END PGP SIGNATURE-----