Summary
Harry Sintonen discovered that curl incorrectly handled SASL
authentication. A remote attacker could use this issue to cause curl to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2018-16839)
Brian Carpenter discovered that curl incorrectly handled memory when
closing certain handles. A remote attacker could use this issue to cause
curl to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2018-16840)
Brian Carpenter discovered that the curl command-line tool incorrectly
handled error messages. A remote attacker could possibly use this issue to
obtain sensitive information. (CVE-2018-16842)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | curl | 7.35.0-1ubuntu2.19 |
| Ubuntu · 16.04 LTS 16.04:LTS | curl | 7.47.0-1ubuntu2.11 |
| Ubuntu · 18.04 LTS 18.04:LTS | curl | 7.58.0-2ubuntu3.5 |
Vulnerabilities 3
-
Medium 4.4
Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function…
-
Medium 4.3
Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to…
-
Medium 4.3
A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy…