Withdrawn by the publisher.

Withdrawn by the publisher.

Affected: CleanStart: curl

Multiple security vulnerabilities affect the curl package. These issues are resolved in later releases. See references for individual vulnerability details.

Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

curl-7.79.1-1.1 on GA media

ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client to hang libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c curl: Integer overflow leading to heap-based buffer overflow in Curl_sasl_create_plain_message() curl: Use-after-free when closing "easy" handle in Curl_close() curl: Heap-based buffer over-read in the curl tool warning formatting curl: NTLM type-2 heap out-of-bounds buffer read curl: Out-of-bounds read in code handling HTTP/2 trailers curl: HTTP authentication leak in redirects curl: FTP path trickery leads to NIL byte out of bounds write curl: LDAP NULL pointer dereference curl: RTSP RTP buffer over-read httpd: privilege escalation from modules scripts curl: NTLMv2 type-3 header stack buffer overflow curl: SMTP end-of-response out-of-bounds read curl: TFTP receive heap buffer overflow in tftp_receive_packet() function

Security update for curl

Affected: Ubuntu:14.04:LTS: curl, Ubuntu:16.04:LTS: curl, Ubuntu:18.04:LTS: curl

Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cURL und libcurl ausnutzen, um Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen und um einen nicht näher spezifizierten Angriff durchzuführen.