Skip to content
OpenAdvisories
Low ALAS2-2019-1233 2 CVEs

Low: curl security update (Amazon Linux 2)

Published Jul 18, 2019 · Updated Jul 22, 2019

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-5436: A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. 1710620: CVE-2019-5436 curl: TFTP receive heap buffer overflow in tftp_receive_packet() function CVE-2019-5435: An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. 1710609: CVE-2019-5435 curl: Integer overflows in curl_url_set() function

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 curl 0:7.61.1-11.amzn2.0.2
Amazon Linux · 2 curl-debuginfo 0:7.61.1-11.amzn2.0.2
Amazon Linux · 2 libcurl 0:7.61.1-11.amzn2.0.2
Amazon Linux · 2 libcurl-devel 0:7.61.1-11.amzn2.0.2

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-5435.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-5436.html