Alessandro Ghedini pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
7d6222ea by Alessandro Ghedini at 2019-02-06T20:55:28Z
Add fixed version for new curl CVEs
- - - - -
c298d18e by Alessandro Ghedini at 2019-02-06T20:55:28Z
Reserve curl DSA
- - - - -
3 changed files:
- data/CVE/list
- data/DSA/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -8345,13 +8345,13 @@ CVE-2019-3824
RESERVED
CVE-2019-3823 [curl: SMTP end-of-response out-of-bounds read]
RESERVED
- - curl <unfixed>
+ - curl 7.64.0-1
NOTE: https://curl.haxx.se/docs/CVE-2019-3823.html
NOTE: Fixed by:
https://github.com/curl/curl/commit/39df4073e5413fcdbb5a38da0c1ce6f1c0ceb484
NOTE: Introduced by:
https://github.com/curl/curl/commit/2766262a68688c1dd8143f9c4be84b46c408b70a
CVE-2019-3822 [curl: NTLMv2 type-3 header stack buffer overflow]
RESERVED
- - curl <unfixed>
+ - curl 7.64.0-1
NOTE: https://curl.haxx.se/docs/CVE-2019-3822.html
NOTE: Fixed by:
https://github.com/curl/curl/commit/50c9484278c63b958655a717844f0721263939cc
NOTE: Introduced by:
https://github.com/curl/curl/commit/86724581b6c02d160b52f817550cfdfc9c93af62
@@ -25982,7 +25982,7 @@ CVE-2018-16891
RESERVED
CVE-2018-16890 [curl: NTLM type-2 out-of-bounds buffer read]
RESERVED
- - curl <unfixed>
+ - curl 7.64.0-1
NOTE: https://curl.haxx.se/docs/CVE-2018-16890.html
NOTE: Fixed by:
https://github.com/curl/curl/commit/b780b30d1377adb10bbe774835f49e9b237fb9bb
NOTE: Introduced by:
https://github.com/curl/curl/commit/86724581b6c02d160b52f817550cfdfc9c93af62
=====================================
data/DSA/list
=====================================
@@ -1,3 +1,6 @@
+[06 Feb 2019] DSA-4386-1 curl - security update
+ {CVE-2018-16890 CVE-2019-3822 CVE-2019-3823}
+ [stretch] - curl 7.52.1-5+deb9u9
[05 Feb 2019] DSA-4385-1 dovecot - security update
{CVE-2019-3814}
[stretch] - dovecot 1:2.2.27-3+deb9u3
=====================================
data/dsa-needed.txt
=====================================
@@ -20,8 +20,6 @@ ansible
--
chromium
--
-curl (ghedo)
---
faad2
not yet fixed upstream
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/compare/5ab2063a8c495e35ed26a7ed897b1ce650a16db5...c298d18e5deae14f41ef87a2e7ea17490c47cec4
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/compare/5ab2063a8c495e35ed26a7ed897b1ce650a16db5...c298d18e5deae14f41ef87a2e7ea17490c47cec4
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
