curl (7.22.0-3ubuntu4.29) precise-security; urgency=medium
[ Marc Deslauriers ]
* SECURITY UPDATE: FTP redirect to malicious host via PASV response
- debian/patches/CVE-2020-8284.patch: use CURLOPT_FTP_SKIP_PASV_IP by
default in lib/url.c, src/main.c.
- CVE-2020-8284
* SECURITY UPDATE: FTP wildcard stack buffer overflow in libcurl
- debian/patches/CVE-2020-8285.patch: make wc_statemach loop instead of
recurse in lib/ftp.c.
- CVE-2020-8285
curl (7.22.0-3ubuntu4.28) precise-security; urgency=medium
[ Marc Deslauriers ]
* SECURITY UPDATE: curl overwrite local file with -J
- debian/patches/CVE-2020-8177.patch: -i is not OK if -J is used in
src/tool_cb_hdr.c, src/tool_getparam.c.
- CVE-2020-8177
curl (7.22.0-3ubuntu4.27) precise-security; urgency=medium
[ Alex Murray ]
* SECURITY UPDATE: heap buffer overflow when receiving TFTP data may
cause denial-of-service or remote code-execution
- debian/patches/CVE-2019-5482.patch: ensure to use the correct block
size when calling recvfrom() if the server returns an OACK without
specifying a block size in lib/tftp.c
- CVE-2019-5482
curl (7.22.0-3ubuntu4.26) precise-security; urgency=medium
[ Marc Deslauriers ]
* SECURITY UPDATE: TFTP receive buffer overflow
- debian/patches/CVE-2019-5436.patch: use the current blksize in
lib/tftp.c.
- CVE-2019-5436
curl (7.22.0-3ubuntu4.24) precise-security; urgency=medium
* SECURITY UPDATE: warning message out-of-buffer read
- debian/patches/CVE-2018-16842.patch: fix bad arithmetic
in src/tool_msgs.c.
- CVE-2018-16842
curl (7.22.0-3ubuntu4.23) precise-security; urgency=medium
* SECURITY UPDATE: Buffer overrun
- debian/patches/CVE-2018-14618.patch: fix in
lib/curl_ntlm_core.c.
- CVE-2018-14618
curl (7.22.0-3ubuntu4.21) precise-security; urgency=medium
* SECURITY UPDATE: Buffer overflow in FTP URL handling
- debian/patches/CVE-2018-1000120.patch: fix in lib/ftp.c,
add test test/data/test340.
- CVE-2018-1000120
* SECURITY UPDATE: LDAP NULL pointer dereference
- debian/patches/CVE-2018-1000121.patch: check ldap_get_attribute_ber()
results for NULL before using in lib/openldap.c.
- CVE-2018-1000121
* SECURITY UPDATE: RTSP RTP buffer over-read
- debian/patches/CVE-2018-1000122.patch: make sure excess reads don't
go beyond buffer end in lib/transfer.c.
- CVE-2018-1000122
* SECURITY UPDATE: RTSP bad headers buffer over-read
- debian/patches/CVE-2018-1000301.patch: restore buffer pointer when
bad response-line is parsed in lib/http.c.
- CVE-2018-1000301
curl (7.22.0-3ubuntu4.20) precise-security; urgency=medium
* SECURITY UPDATE: leak authentication data
- debian/patches/CVE-2018-1000007.patch: prevent custom
authorization headers in redirects in lib/http.c,
lib/url.c, lib/urldata.h, tests/data/Makefile.in,
tests/data/test317, tests/data/test318.
- CVE-2018-1000007
curl (7.22.0-3ubuntu4.19) precise-security; urgency=medium
[ Marc Deslauriers ]
* SECURITY UPDATE: FTP wildcard out of bounds read
- debian/patches/CVE-2017-8817.patch: fix heap buffer overflow in
setcharset in lib/curl_fnmatch.c, added tests to
tests/data/Makefile.inc, tests/data/test1163.
- CVE-2017-8817
curl (7.22.0-3ubuntu4.18) precise-security; urgency=medium
* SECURITY UPDATE: printf floating point buffer overflow
- debian/patches/CVE-2016-9586.patch: fix floating point buffer
overflow issues in lib/mprintf.c, added test to tests/data/test557,
tests/libtest/lib557.c.
- CVE-2016-9586
* SECURITY UPDATE: TFTP sends more than buffer size
- debian/patches/CVE-2017-1000100.patch: reject file name lengths that
don't fit in lib/tftp.c.
- CVE-2017-1000100
* SECURITY UPDATE: FTP PWD response parser out of bounds read
- debian/patches/CVE-2017-1000254.patch: zero terminate the entry path
even on bad input in lib/ftp.c, added test to
tests/data/Makefile.am, tests/data/test1152.
- CVE-2017-1000254
* SECURITY UPDATE: --write-out out of buffer read
- debian/patches/CVE-2017-7407-1.patch: fix a buffer read overrun in
src/writeout.c added test to tests/data/Makefile.am,
tests/data/test1440, tests/data/test1441.
- debian/patches/CVE-2017-7407-2.patch: check for end of input in
src/_writeout.c added test to tests/data/Makefile.am,
tests/data/test1442.
- CVE-2017-7407
* SECURITY UPDATE: IMAP FETCH response out of bounds read
- debian/patches/CVE-2017-1000257.patch: check size in lib/imap.c.
- CVE-2017-1000257
Date: 2020-12-04 15:08:43.959595+00:00
Changed-By: leo.barb...@canonical.com (Leonidas S. Barbosa)
Signed-By: Steve Langasek <steve.langa...@canonical.com>
https://launchpad.net/ubuntu/+source/curl/7.22.0-3ubuntu4.29
Sorry, changesfile not available.
--
Precise-changes mailing list
Precise-changes@lists.ubuntu.com
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/precise-changes
