SUSE-SU-2018:0214-1: moderate: Security update for curl
sle-security-updates at lists.suse.com
sle-security-updates at lists.suse.com
Thu Jan 25 07:25:28 MST 2018
SUSE Security Update: Security update for curl
______________________________________________________________________________
Announcement ID: SUSE-SU-2018:0214-1
Rating: moderate
References: #1027712 #1061876 #1077001
Cross-References: CVE-2017-1000254 CVE-2018-1000007
Affected Products:
SUSE Studio Onsite 1.3
______________________________________________________________________________
An update that solves two vulnerabilities and has one
errata is now available.
Description:
This update for curl fixes several issues.
These security issues were fixed:
- CVE-2017-1000254: Fix FTP PWD response parser out of bounds read
(bsc#1061876).
- CVE-2018-1000007: Prevent leaking authentication data to third parties
when following redirects (bsc#1077001)
Also the following adjustment was made:
- Set DEFAULT_SUSE as the default cipher list (bsc#1027712)
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Studio Onsite 1.3:
zypper in -t patch slestso13-curl-13436=1
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Studio Onsite 1.3 (x86_64):
libcurl-devel-7.19.7-1.20.53.13.1
References:
https://www.suse.com/security/cve/CVE-2017-1000254.html
https://www.suse.com/security/cve/CVE-2018-1000007.html
https://bugzilla.suse.com/1027712
https://bugzilla.suse.com/1061876
https://bugzilla.suse.com/1077001
More information about the sle-security-updates
mailing list