ELSA-2020-1792 — Moderate: curl security update (Oracle Linux 8)

Summary

[7.61.1-12]
- double free due to subsequent call of realloc() (CVE-2019-5481)
- fix heap buffer overflow in function tftp_receive_packet() (CVE-2019-5482)
- fix TFTP receive buffer overflow (CVE-2019-5436)

Fixed packages 4

Release	Package	Fixed in
Oracle Linux · 8	curl	0:7.61.1-12.el8
Oracle Linux · 8	libcurl	0:7.61.1-12.el8
Oracle Linux · 8	libcurl-devel	0:7.61.1-12.el8
Oracle Linux · 8	libcurl-minimal	0:7.61.1-12.el8

Vulnerabilities 3

Critical 9.8

CVE-2019-5481

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

curl curl curl gnurl Debian Ubuntu Alpine

Sep 16, 2019
Critical 9.8

CVE-2019-5482 EPSS 18%

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

curl curl curl gnurl Debian Ubuntu Alpine

Sep 16, 2019
High 7.8

CVE-2019-5436 EPSS 50%

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4…

curl curl curl curl Debian Ubuntu Alpine

May 28, 2019

Moderate: curl security update (Oracle Linux 8)

Summary

Fixed packages 4

Vulnerabilities 3

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4…