Red Hat Security Advisory: curl security and bug fix update

Fixed packages 9

Vulnerabilities 4

• High 7.1
  CVE-2019-3822 EPSS 13%

  libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an…

  The curl Project curl curl curl Debian Ubuntu Alpine
  Feb 6, 2019
• Medium 5.4
  CVE-2018-16890 Public exploit

  libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling …

  The curl Project curl curl curl Debian Ubuntu Alpine
  Feb 6, 2019
• Medium 4.3
  CVE-2019-3823

  libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-…

  The curl Project curl curl curl Debian Ubuntu Alpine
  Feb 6, 2019
• Unscored —
  CVE-2018-20483

  set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata a…

  wget wget wget Debian Ubuntu Alpine
  Dec 26, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1662705
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1669156
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1670252
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1670254
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1670256
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3701.json
• report
  https://access.redhat.com/security/cve/CVE-2018-16890
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16890
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16890
• article
  https://curl.haxx.se/docs/CVE-2018-16890.html
• report
  https://access.redhat.com/security/cve/CVE-2018-20483
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-20483
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-20483
• article
  http://git.savannah.gnu.org/cgit/wget.git/tree/NEWS
• report
  https://access.redhat.com/security/cve/CVE-2019-3822
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-3822
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-3822
• article
  https://curl.haxx.se/docs/CVE-2019-3822.html
• report
  https://access.redhat.com/security/cve/CVE-2019-3823
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-3823
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-3823
• article
  https://curl.haxx.se/docs/CVE-2019-3823.html