[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[USN-3710-1] curl vulnerability

Ubuntu Security Notice USN-3710-1
July 11, 2018

curl vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS
- Ubuntu 17.10


curl could be made to crash or run programs if it received specially
crafted network traffic.

Software Description:
- curl: HTTP, HTTPS, and FTP client and client libraries


Peter Wu discovered that curl incorrectly handled certain SMTP buffers. A
remote attacker could use this issue to cause curl to crash, resulting in a
denial of service, or possibly execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
  curl                            7.58.0-2ubuntu3.2
  libcurl3-gnutls                 7.58.0-2ubuntu3.2
  libcurl3-nss                    7.58.0-2ubuntu3.2
  libcurl4                        7.58.0-2ubuntu3.2

Ubuntu 17.10:
  curl                            7.55.1-1ubuntu2.6
  libcurl3                        7.55.1-1ubuntu2.6
  libcurl3-gnutls                 7.55.1-1ubuntu2.6
  libcurl3-nss                    7.55.1-1ubuntu2.6

In general, a standard system update will make all the necessary changes.


Package Information:

Attachment: signature.asc
Description: OpenPGP digital signature

ubuntu-security-announce mailing list
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce