Summary
Bru Rom discovered that curl incorrectly handled client certificates when
resuming a TLS session. (CVE-2016-5419)
It was discovered that curl incorrectly handled client certificates when
reusing TLS connections. (CVE-2016-5420)
Marcelo Echeverria and Fernando Muñoz discovered that curl incorrectly
reused a connection struct, contrary to expectations. This issue only
applied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5421)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | curl | 7.35.0-1ubuntu2.8 |
| Ubuntu · 16.04 LTS 16.04:LTS | curl | 7.47.0-1ubuntu2.1 |
Vulnerabilities 3
-
Unscored —CVE-2016-5419 EPSS 15%
curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which all…
-
Unscored —CVE-2016-5420 EPSS 15%
curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which mig…
-
Unscored —
Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly …