Risks
Advisories
Browse
or
or
Slackware Security Advisory - curl (SSA:2013-038-01)
[slackware-security]  curl (SSA:2013-038-01)

New curl packages are available for Slackware 14.0, and -current to
fix a security issue.


Here are the details from the Slackware 14.0 ChangeLog:
+--------------------------+
patches/packages/curl-7.29.0-i486-1_slack14.0.txz:  Upgraded.
  When negotiating SASL DIGEST-MD5 authentication, the function
  Curl_sasl_create_digest_md5_message() uses the data provided from the
  server without doing the proper length checks and that data is then
  appended to a local fixed-size buffer on the stack.  This vulnerability
  can be exploited by someone who is in control of a server that a libcurl
  based program is accessing with POP3, SMTP or IMAP.  For applications
  that accept user provided URLs, it is also thinkable that a malicious
  user would feed an application with a URL to a server hosting code
  targeting this flaw.
  Affected versions: curl 7.26.0 to and including 7.28.1
  For more information, see:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0249
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/curl-7.29.0-i48
6-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/curl-7.29.0-x
86_64-1_slack14.0.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/curl-7.29.0-i486-
1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/curl-7.29.0-x
86_64-1.txz


MD5 signatures:
+-------------+

Slackware 14.0 package:
f235fe8f505ce0f3436fdea3625c3bdf  curl-7.29.0-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
f7359f77338c2475e654ff2c0204210e  curl-7.29.0-x86_64-1_slack14.0.txz

Slackware -current package:
eff523206400dde2b50bd4b20fbf0e64  n/curl-7.29.0-i486-1.txz

Slackware x86_64 -current package:
8dccef537d72d7297e4907db7cd160ef  n/curl-7.29.0-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg curl-7.29.0-i486-1_slack14.0.txz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com




Spotlight

Almost 1 in 10 Android apps are now malware

Posted on 28 July 2014.  |  Cheetah Mobile Threat Research Labs analyzed trends in mobile viruses for Q1 and Q2 of 2014. Pulling 24.4 million sample files they found that 2.2 million files had viruses. This is a 153% increase from the number of infected files in 2013.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Mon, Jul 28th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //