lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 28 Mar 2015 12:09:01 +0100
Subject: [ MDVSA-2015:098 ] curl

Hash: SHA1


 Mandriva Linux Security Advisory                         MDVSA-2015:098

 Package : curl
 Date    : March 28, 2015
 Affected: Business Server 2.0

 Problem Description:

 Updated curl packages fix security vulnerabilities:
 Paras Sethia discovered that libcurl would sometimes mix up multiple
 HTTP and HTTPS connections with NTLM authentication to the same server,
 sending requests for one user over the connection authenticated as
 a different user (CVE-2014-0015).
 libcurl can in some circumstances re-use the wrong connection when
 asked to do transfers using other protocols than HTTP and FTP, causing
 a transfer that was initiated by an application to wrongfully re-use
 an existing connection to the same server that was authenticated
 using different credentials (CVE-2014-0138).
 libcurl incorrectly validates wildcard SSL certificates containing
 literal IP addresses, so under certain conditions, it would allow
 and use a wildcard match specified in the CN field, allowing a
 malicious server to participate in a MITM attack or just fool users
 into believing that it is a legitimate site (CVE-2014-0139).
 In cURL before 7.38.0, libcurl can be fooled to both sending cookies
 to wrong sites and into allowing arbitrary sites to set cookies for
 others. For this problem to trigger, the client application must use
 the numerical IP address in the URL to access the site (CVE-2014-3613).
 In cURL before 7.38.0, libcurl wrongly allows cookies to be set for Top
 Level Domains (TLDs), thus making them apply broader than cookies are
 allowed. This can allow arbitrary sites to set cookies that then would
 get sent to a different and unrelated site or domain (CVE-2014-3620).
 Symeon Paraschoudis discovered that the curl_easy_duphandle() function
 in cURL has a bug that can lead to libcurl eventually sending off
 sensitive data that was not intended for sending, while performing
 a HTTP POST operation. This bug requires CURLOPT_COPYPOSTFIELDS and
 curl_easy_duphandle() to be used in that order, and then the duplicate
 handle must be used to perform the HTTP POST. The curl command line
 tool is not affected by this problem as it does not use this sequence
 When libcurl sends a request to a server via a HTTP proxy, it copies
 the entire URL into the request and sends if off. If the given URL
 contains line feeds and carriage returns those will be sent along to
 the proxy too, which allows the program to for example send a separate
 HTTP request injected embedded in the URL (CVE-2014-8150).


 Updated Packages:

 Mandriva Business Server 2/X86_64:
 498d59be3a6a4ace215c0d98fb4abede  mbs2/x86_64/curl-7.34.0-3.1.mbs2.x86_64.rpm
 75a821b73a75ca34f1747a0f7479267f  mbs2/x86_64/curl-examples-7.34.0-3.1.mbs2.noarch.rpm
 f5d3aad5f0fd9db68b87c648aaabbb4a  mbs2/x86_64/lib64curl4-7.34.0-3.1.mbs2.x86_64.rpm
 4f356a2c97f9f64124b4e8ebe307826a  mbs2/x86_64/lib64curl-devel-7.34.0-3.1.mbs2.x86_64.rpm 
 d010a357d76a8eb967c7c52f92fb35ae  mbs2/SRPMS/curl-7.34.0-3.1.mbs2.src.rpm

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver 0x22458A98

 You can view other update advisories for Mandriva Linux at:

 If you want to report vulnerabilities, please contact


 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
Version: GnuPG v1.4.12 (GNU/Linux)


Powered by blists - more mailing lists