ELSA-2019-1880

ELSA-2019-1880 - curl security and bug fix update

Type:SECURITY
Severity:LOW
Release Date:2019-07-30

Description


[7.29.0-51.0.1.el7_6.3]
- Security Fixes [OraBug: 28939992]
- CVE-2016-8615 cookie injection for other servers (https://curl.haxx.se/docs/CVE-2016-8615.html)
- CVE-2016-8616 case insensitive password comparison (https://curl.haxx.se/docs/CVE-2016-8616.html)
- CVE-2016-8617 OOB write via unchecked multiplication (https://curl.haxx.se/docs/CVE-2016-8617.html)
- CVE-2016-8618 double-free in curl_maprintf (https://curl.haxx.se/docs/CVE-2016-8618.html)
- CVE-2016-8619 double-free in krb5 code (https://curl.haxx.se/docs/CVE-2016-8619.html)
- CVE-2016-8621 curl_getdate read out of bounds (https://curl.haxx.se/docs/CVE-2016-8621.html)
- CVE-2016-8622 URL unescape heap overflow via integer truncation (https://curl.haxx.se/docs/CVE-2016-8622.html)
- CVE-2016-8623 Use-after-free via shared cookies (https://curl.haxx.se/docs/CVE-2016-8623.html)
- CVE-2016-8624 invalid URL parsing with # (https://curl.haxx.se/docs/CVE-2016-8624.html)

[7.29.0-51.el7_6.3]
- fix NTLM password overflow via integer overflow (CVE-2018-14618)

[7.29.0-51.el7_6.2]
- prevent curl --rate-limit from crashing on https URLs (#1683292)

[7.29.0-51.el7_6.1]
- prevent curl --rate-limit from hanging on file URLs (#1281969)


Related CVEs


CVE-2018-14618

Updated Packages


Release/ArchitectureFilenameMD5sumSuperseded By Advisory
Oracle Linux 7 (aarch64) curl-7.29.0-51.0.1.el7_6.3.src.rpm6a0e7697d758912537e0fd9fc966785f-
curl-7.29.0-51.0.1.el7_6.3.aarch64.rpmfcbda29c1dac8ae38c512fcdde066a32-
libcurl-7.29.0-51.0.1.el7_6.3.aarch64.rpm40385a5da23322c735c6fbd4421a5bf5-
libcurl-devel-7.29.0-51.0.1.el7_6.3.aarch64.rpm0aa7eb5d8c05fd6a5a7f5acf6e739304-
Oracle Linux 7 (x86_64) curl-7.29.0-51.0.1.el7_6.3.src.rpm6a0e7697d758912537e0fd9fc966785f-
curl-7.29.0-51.0.1.el7_6.3.x86_64.rpm0d0237a0f4e13ddb0a598030ee244fbd-
libcurl-7.29.0-51.0.1.el7_6.3.i686.rpm4c6e53387d8b1f5204366cbd08917ff5-
libcurl-7.29.0-51.0.1.el7_6.3.x86_64.rpm5a5a9577b46c7c87b01c634736b01b71-
libcurl-devel-7.29.0-51.0.1.el7_6.3.i686.rpmf6dfa71cfeb6479000775d829e249b60-
libcurl-devel-7.29.0-51.0.1.el7_6.3.x86_64.rpm952cc280a39a6bfea47d6c9957fd18bd-



This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team

software.hardware.complete