Security update for curl SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:0794-1 Final 1 1 2018-03-23T17:56:55Z current 2018-03-23T17:56:55Z 2018-03-23T17:56:55Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for curl This update for curl fixes the following issues: Following security issues were fixed: - CVE-2018-1000120: A buffer overflow exists in the FTP URL handling that allowed an attacker to cause a denial of service or possible code execution (bsc#1084521). - CVE-2018-1000121: A NULL pointer dereference exists in the LDAP code that allowed an attacker to cause a denial of service (bsc#1084524). - CVE-2018-1000122: A buffer over-read exists in the RTSP+RTP handling code that allowed an attacker to cause a denial of service or information leakage (bsc#1084532). This update was imported from the SUSE:SLE-12:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2018-03/msg00084.html E-Mail link for openSUSE-SU-2018:0794-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 curl-7.37.0-33.1 libcurl-devel-7.37.0-33.1 libcurl-devel-32bit-7.37.0-33.1 libcurl4-7.37.0-33.1 libcurl4-32bit-7.37.0-33.1 curl-7.37.0-33.1 as a component of openSUSE Leap 42.3 libcurl-devel-7.37.0-33.1 as a component of openSUSE Leap 42.3 libcurl-devel-32bit-7.37.0-33.1 as a component of openSUSE Leap 42.3 libcurl4-7.37.0-33.1 as a component of openSUSE Leap 42.3 libcurl4-32bit-7.37.0-33.1 as a component of openSUSE Leap 42.3 A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse. CVE-2018-1000120 openSUSE Leap 42.3:curl-7.37.0-33.1 openSUSE Leap 42.3:libcurl-devel-32bit-7.37.0-33.1 openSUSE Leap 42.3:libcurl-devel-7.37.0-33.1 openSUSE Leap 42.3:libcurl4-32bit-7.37.0-33.1 openSUSE Leap 42.3:libcurl4-7.37.0-33.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-03/msg00084.html https://www.suse.com/security/cve/CVE-2018-1000120.html CVE-2018-1000120 https://bugzilla.suse.com/1084521 SUSE Bug 1084521 https://bugzilla.suse.com/1101811 SUSE Bug 1101811 https://bugzilla.suse.com/1112526 SUSE Bug 1112526 A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service CVE-2018-1000121 openSUSE Leap 42.3:curl-7.37.0-33.1 openSUSE Leap 42.3:libcurl-devel-32bit-7.37.0-33.1 openSUSE Leap 42.3:libcurl-devel-7.37.0-33.1 openSUSE Leap 42.3:libcurl4-32bit-7.37.0-33.1 openSUSE Leap 42.3:libcurl4-7.37.0-33.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-03/msg00084.html https://www.suse.com/security/cve/CVE-2018-1000121.html CVE-2018-1000121 https://bugzilla.suse.com/1084524 SUSE Bug 1084524 https://bugzilla.suse.com/1085215 SUSE Bug 1085215 https://bugzilla.suse.com/1101811 SUSE Bug 1101811 https://bugzilla.suse.com/1112526 SUSE Bug 1112526 A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage CVE-2018-1000122 openSUSE Leap 42.3:curl-7.37.0-33.1 openSUSE Leap 42.3:libcurl-devel-32bit-7.37.0-33.1 openSUSE Leap 42.3:libcurl-devel-7.37.0-33.1 openSUSE Leap 42.3:libcurl4-32bit-7.37.0-33.1 openSUSE Leap 42.3:libcurl4-7.37.0-33.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-03/msg00084.html https://www.suse.com/security/cve/CVE-2018-1000122.html CVE-2018-1000122 https://bugzilla.suse.com/1084532 SUSE Bug 1084532 https://bugzilla.suse.com/1101811 SUSE Bug 1101811 https://bugzilla.suse.com/1112526 SUSE Bug 1112526