Summary
curl
[7.29.0-51]
- require a new enough version of nss-pem to avoid regression in yum (#1610998)
[7.29.0-50]
- remove dead code, detected by Coverity Analysis
- remove unused variable, detected by GCC and Clang
[7.29.0-49]
- make curl --speed-limit work with TFTP (#1584750)
[7.29.0-48]
- fix RTSP bad headers buffer over-read (CVE-2018-1000301)
- fix FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)
- fix LDAP NULL pointer dereference (CVE-2018-1000121)
- fix RTSP RTP buffer over-read (CVE-2018-1000122)
- http: prevent custom Authorization headers in redirects (CVE-2018-1000007)
- doc: --tlsauthtype works only if built with TLS-SRP support (#1542256)
- update certificates in the test-suite because they expire soon (#1572723)
[7.29.0-47]
- make NSS deallocate PKCS #11 objects early enough (#1510247)
nss-pem
[1.0.3-5]
- update object ID while reusing a certificate (#1610998)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | curl | 0:7.29.0-51.el7 |
| Oracle Linux · 7 | libcurl | 0:7.29.0-51.el7 |
| Oracle Linux · 7 | libcurl-devel | 0:7.29.0-51.el7 |
| Oracle Linux · 7 | nss-pem | 0:1.0.3-5.el7 |
Vulnerabilities 5
-
Critical 9.8CVE-2018-1000120 EPSS 12%
curl FTP path confusion leads to NIL byte out of bounds write
A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.
-
Critical 9.1
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of s…
-
Unscored —
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom head…
-
Unscored —
A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker …
-
Unscored —
A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an atta…