Bug 10338

Summary: curl packages fix security vulnerabilities CVE-2019-5435 , CVE-2019-5436 , CVE-2019-5481 , CVE-2019-5482
Product: [ROSA-based products] ROSA Fresh Reporter: Zombie Ryushu <zombie.ryushu>
Component: Packages from MainAssignee: ROSA Linux Bugs <bugs>
Status: RESOLVED DUPLICATE QA Contact: ROSA Linux Bugs <bugs>
Severity: normal    
Priority: Normal CC: alzim, andrey.bondrov, denis.silakov, mc2374
Version: All   
Target Milestone: ---   
Hardware: All   
OS: Linux   
URL: https://advisories.mageia.org/MGASA-2019-0337.html
Whiteboard:
Platform: --- ROSA Vulnerability identifier: CVE-2019-5435 , CVE-2019-5436 , CVE-2019-5481 , CVE-2019-5482
RPM Package: curl ISO-related:
Bad POT generating: Upstream:

Description Zombie Ryushu 2019-11-30 17:09:17 MSK 
The updated packages fix security vulnerabilities:

An integer overflow in curl's URL API results in a buffer overflow
in libcurl 7.62.0 to and including 7.64.1. (CVE-2019-5435)

A heap buffer overflow in the TFTP receiving code allows for DoS or
arbitrary code execution in libcurl versions 7.19.4 through 7.64.1
(CVE-2019-5436).

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to
7.65.3 (CVE-2019-5481).

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to
7.65.3 (CVE-2019-5482).
Comment 1 Алзим 2019-11-30 18:53:18 MSK 
Rosa 2016.1
Version:	7.66.0

https://abf.io/import/curl/blob/rosa2016.1/curl.spec?#lc-9
Comment 2 Алзим 2019-11-30 18:54:47 MSK 

*** This bug has been marked as a duplicate of bug 10149 ***