========================================================================== Ubuntu Security Notice USN-3457-1 October 23, 2017
curl vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 17.10 - Ubuntu 17.04 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: curl could be made to crash or run programs if it received specially crafted network traffic. Software Description: - curl: HTTP, HTTPS, and FTP client and client libraries Details: Brian Carpenter discovered that curl incorrectly handled IMAP FETCH response lines. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 17.10: curl 7.55.1-1ubuntu2.1 libcurl3 7.55.1-1ubuntu2.1 libcurl3-gnutls 7.55.1-1ubuntu2.1 libcurl3-nss 7.55.1-1ubuntu2.1 Ubuntu 17.04: curl 7.52.1-4ubuntu1.3 libcurl3 7.52.1-4ubuntu1.3 libcurl3-gnutls 7.52.1-4ubuntu1.3 libcurl3-nss 7.52.1-4ubuntu1.3 Ubuntu 16.04 LTS: curl 7.47.0-1ubuntu2.4 libcurl3 7.47.0-1ubuntu2.4 libcurl3-gnutls 7.47.0-1ubuntu2.4 libcurl3-nss 7.47.0-1ubuntu2.4 Ubuntu 14.04 LTS: curl 7.35.0-1ubuntu2.12 libcurl3 7.35.0-1ubuntu2.12 libcurl3-gnutls 7.35.0-1ubuntu2.12 libcurl3-nss 7.35.0-1ubuntu2.12 In general, a standard system update will make all the necessary changes. References: https://www.ubuntu.com/usn/usn-3457-1 CVE-2017-1000257 Package Information: https://launchpad.net/ubuntu/+source/curl/7.55.1-1ubuntu2.1 https://launchpad.net/ubuntu/+source/curl/7.52.1-4ubuntu1.3 https://launchpad.net/ubuntu/+source/curl/7.47.0-1ubuntu2.4 https://launchpad.net/ubuntu/+source/curl/7.35.0-1ubuntu2.12
signature.asc
Description: OpenPGP digital signature
-- ubuntu-security-announce mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
