[ASA-201811-4] curl: multiple issues
foxboron at archlinux.org
Sat Nov 10 20:45:43 UTC 2018
Arch Linux Security Advisory ASA-201811-4
Date : 2018-11-06
CVE-ID : CVE-2018-16840 CVE-2018-16842
Package : curl
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-795
The package curl before version 7.62.0-1 is vulnerable to multiple
issues including arbitrary code execution and information disclosure.
Upgrade to 7.62.0-1.
# pacman -Syu "curl>=7.62.0-1"
The problems have been fixed upstream in version 7.62.0.
- CVE-2018-16840 (arbitrary code execution)
A heap use-after-free flaw was found in curl versions from 7.59.0
through 7.61.1 in the code related to closing an easy handle. When
closing and cleaning up an 'easy' handle in the `Curl_close()`
function, the library code first frees a struct (without nulling the
pointer) and might then subsequently erroneously write to a struct
field within that already freed struct.
- CVE-2018-16842 (information disclosure)
Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based
buffer over-read in the tool_msgs.c:voutf() function that may result in
information exposure and denial of service.
This display function formats the output to wrap at 80 columns. The
wrap logic is however flawed, so if a single word in the message is
itself longer than 80 bytes the buffer arithmetic calculates the
remainder wrong and will end up reading behind the end of the buffer.
A malicious remote server could execute arbitrary commands by closing
the client initialized with easy handlers. A malicious local user could
disclose information and crash the application if invalid flags were
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security