[ASA-201905-11] libcurl-compat: arbitrary code execution
rgacogne at archlinux.org
Fri May 31 15:53:29 UTC 2019
Arch Linux Security Advisory ASA-201905-11
Date : 2019-05-31
CVE-ID : CVE-2019-5436
Package : libcurl-compat
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-959
The package libcurl-compat before version 7.65.0-1 is vulnerable to
arbitrary code execution.
Upgrade to 7.65.0-1.
# pacman -Syu "libcurl-compat>=7.65.0-1"
The problem has been fixed upstream in version 7.65.0.
libcurl before 7.65.0 contains a heap buffer overflow in the function
(tftp_receive_packet()) that receives data from a TFTP server. It calls
recvfrom() with the default size for the buffer rather than with the
size that was used to allocate it. Thus, the content that might
overwrite the heap memory is entirely controlled by the server.
The flaw exists if the user selects to use a "blksize" of 504 or
smaller (default is 512). The smaller size that is used, the larger the
possible overflow becomes. Users choosing a smaller size than default
should be rare as the primary use case for changing the size is to make
A malicious TFTP server can execute arbitrary code on the affected
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: OpenPGP digital signature
More information about the arch-security