Summary
[7.61.1-11]
- rebuild with updated annobin to prevent Execshield RPMDiff check from failing
[7.61.1-10]
- fix SMTP end-of-response out-of-bounds read (CVE-2019-3823)
- fix NTLMv2 type-3 header stack buffer overflow (CVE-2019-3822)
- fix NTLM type-2 out-of-bounds buffer read (CVE-2018-16890)
- xattr: strip credentials from any URL that is stored (CVE-2018-20483)
[7.61.1-9]
- do not let libssh create a new socket for SCP/SFTP (#1669156)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | curl | 0:7.61.1-11.el8 |
| Oracle Linux · 8 | libcurl | 0:7.61.1-11.el8 |
| Oracle Linux · 8 | libcurl-devel | 0:7.61.1-11.el8 |
| Oracle Linux · 8 | libcurl-minimal | 0:7.61.1-11.el8 |
Vulnerabilities 4
-
High 7.1CVE-2019-3822 EPSS 13%
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an…
-
Medium 5.4CVE-2018-16890 Public exploit
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling …
-
Medium 4.3
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-…
-
Unscored —
set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata a…