[ASA-201811-4] curl: multiple issues

[Morten Linderud]

Arch Linux Security Advisory ASA-201811-4
=========================================

Severity: High
Date    : 2018-11-06
CVE-ID  : CVE-2018-16840 CVE-2018-16842
Package : curl
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-795

Summary
=======

The package curl before version 7.62.0-1 is vulnerable to multiple
issues including arbitrary code execution and information disclosure.

Resolution
==========

Upgrade to 7.62.0-1.

# pacman -Syu "curl>=7.62.0-1"

The problems have been fixed upstream in version 7.62.0.

Workaround
==========

None.

Description
===========

- CVE-2018-16840 (arbitrary code execution)

A heap use-after-free flaw was found in curl versions from 7.59.0
through 7.61.1 in the code related to closing an easy handle. When
closing and cleaning up an 'easy' handle in the `Curl_close()`
function, the library code first frees a struct (without nulling the
pointer) and might then subsequently erroneously write to a struct
field within that already freed struct.

- CVE-2018-16842 (information disclosure)

Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based
buffer over-read in the tool_msgs.c:voutf() function that may result in
information exposure and denial of service.
This display function formats the output to wrap at 80 columns. The
wrap logic is however flawed, so if a single word in the message is
itself longer than 80 bytes the buffer arithmetic calculates the
remainder wrong and will end up reading behind the end of the buffer.

Impact
======

A malicious remote server could execute arbitrary commands by closing
the client initialized with easy handlers. A malicious local user could
disclose information and crash the application if invalid flags were
passed.

References
==========

https://curl.haxx.se/docs/CVE-2018-16840.html
https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f
https://curl.haxx.se/docs/CVE-2018-16842.html
https://github.com/curl/curl/commit/d530e92f59ae9bb2d47066c3c460b25d2ffeb211
https://security.archlinux.org/CVE-2018-16840
https://security.archlinux.org/CVE-2018-16842
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20181110/11332be5/attachment.asc>