Paketname
curl
Datum
2014-06-10
Advisory ID
MDVSA-2014:110
Betroffene Versionen
MES5 i586 , MBS1 x86_64 , MES5 x86_64

Problembeschreibung

Updated curl packages fix security vulnerabilities:

Paras Sethia discovered that libcurl would sometimes mix up multiple
HTTP and HTTPS connections with NTLM authentication to the same server,
sending requests for one user over the connection authenticated as
a different user (CVE-2014-0015).

libcurl can in some circumstances re-use the wrong connection when
asked to do transfers using other protocols than HTTP and FTP, causing
a transfer that was initiated by an application to wrongfully re-use
an existing connection to the same server that was authenticated
using different credentials (CVE-2014-0138).

libcurl incorrectly validates wildcard SSL certificates containing
literal IP addresses, so under certain conditions, it would allow
and use a wildcard match specified in the CN field, allowing a
malicious server to participate in a MITM attack or just fool users
into believing that it is a legitimate site (CVE-2014-0139).

Aktualisierte Pakete

MES5 i586

 dbfc65c19ac0479b0f171fb2f57b7009  mes5/i586/curl-7.19.0-2.9mdvmes5.2.i586.rpm
 329ea6986634f8115f0f40189dafa13d  mes5/i586/curl-examples-7.19.0-2.9mdvmes5.2.i586.rpm
 e90929468892b409168cbaaf5ccf7aa7  mes5/i586/libcurl4-7.19.0-2.9mdvmes5.2.i586.rpm
 b76ba081a80e5305b3ea502331d339f1  mes5/i586/libcurl-devel-7.19.0-2.9mdvmes5.2.i586.rpm 
 079bba263ad5eba412c40e97b088ff49  mes5/SRPMS/curl-7.19.0-2.9mdvmes5.2.src.rpm

MBS1 x86_64

 59896a7f65dc52adff833b191c2ccd8d  mbs1/x86_64/curl-7.24.0-3.5.mbs1.x86_64.rpm
 c519acfcdfd464dce34e5d85642cddae  mbs1/x86_64/curl-examples-7.24.0-3.5.mbs1.x86_64.rpm
 c9c4ccf43b0115c3faf24ae6c0a4ef51  mbs1/x86_64/lib64curl4-7.24.0-3.5.mbs1.x86_64.rpm
 9d8d2a5cbffd1ba844d1a6c7837f2298  mbs1/x86_64/lib64curl-devel-7.24.0-3.5.mbs1.x86_64.rpm 
 9dbb683a4ebda2ad649562fd66c9cb87  mbs1/SRPMS/curl-7.24.0-3.5.mbs1.src.rpm

MES5 x86_64

 d51a98de165924c8eb83db16cd2a9de1  mes5/x86_64/curl-7.19.0-2.9mdvmes5.2.x86_64.rpm
 2d6dba13c1b95fe669eeee6ef618e6d2  mes5/x86_64/curl-examples-7.19.0-2.9mdvmes5.2.x86_64.rpm
 3e92dcf0f85218afd68cdf12b81b7639  mes5/x86_64/lib64curl4-7.19.0-2.9mdvmes5.2.x86_64.rpm
 035cea9d1c4d9f30e442113c1890da29  mes5/x86_64/lib64curl-devel-7.19.0-2.9mdvmes5.2.x86_64.rpm 
 079bba263ad5eba412c40e97b088ff49  mes5/SRPMS/curl-7.19.0-2.9mdvmes5.2.src.rpm

Referenzen