curl-7.79.1-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:10582-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z curl-7.79.1-1.1 on GA media These are all security issues fixed in the curl-7.79.1-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-10582 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2006-1061/ SUSE CVE CVE-2006-1061 page https://www.suse.com/security/cve/CVE-2016-9586/ SUSE CVE CVE-2016-9586 page https://www.suse.com/security/cve/CVE-2016-9594/ SUSE CVE CVE-2016-9594 page https://www.suse.com/security/cve/CVE-2017-1000099/ SUSE CVE CVE-2017-1000099 page https://www.suse.com/security/cve/CVE-2017-1000100/ SUSE CVE CVE-2017-1000100 page https://www.suse.com/security/cve/CVE-2017-1000101/ SUSE CVE CVE-2017-1000101 page https://www.suse.com/security/cve/CVE-2017-1000254/ SUSE CVE CVE-2017-1000254 page https://www.suse.com/security/cve/CVE-2017-1000257/ SUSE CVE CVE-2017-1000257 page https://www.suse.com/security/cve/CVE-2017-2629/ SUSE CVE CVE-2017-2629 page https://www.suse.com/security/cve/CVE-2017-7468/ SUSE CVE CVE-2017-7468 page https://www.suse.com/security/cve/CVE-2017-8816/ SUSE CVE CVE-2017-8816 page https://www.suse.com/security/cve/CVE-2017-8817/ SUSE CVE CVE-2017-8817 page https://www.suse.com/security/cve/CVE-2017-8818/ SUSE CVE CVE-2017-8818 page https://www.suse.com/security/cve/CVE-2017-9502/ SUSE CVE CVE-2017-9502 page https://www.suse.com/security/cve/CVE-2018-0500/ SUSE CVE CVE-2018-0500 page https://www.suse.com/security/cve/CVE-2018-1000005/ SUSE CVE CVE-2018-1000005 page https://www.suse.com/security/cve/CVE-2018-1000120/ SUSE CVE CVE-2018-1000120 page https://www.suse.com/security/cve/CVE-2018-1000122/ SUSE CVE CVE-2018-1000122 page https://www.suse.com/security/cve/CVE-2018-1000300/ SUSE CVE CVE-2018-1000300 page https://www.suse.com/security/cve/CVE-2018-1000301/ SUSE CVE CVE-2018-1000301 page https://www.suse.com/security/cve/CVE-2018-14618/ SUSE CVE CVE-2018-14618 page https://www.suse.com/security/cve/CVE-2018-16839/ SUSE CVE CVE-2018-16839 page https://www.suse.com/security/cve/CVE-2018-16840/ SUSE CVE CVE-2018-16840 page https://www.suse.com/security/cve/CVE-2018-16842/ SUSE CVE CVE-2018-16842 page https://www.suse.com/security/cve/CVE-2018-16890/ SUSE CVE CVE-2018-16890 page https://www.suse.com/security/cve/CVE-2019-15601/ SUSE CVE CVE-2019-15601 page https://www.suse.com/security/cve/CVE-2019-3822/ SUSE CVE CVE-2019-3822 page https://www.suse.com/security/cve/CVE-2019-3823/ SUSE CVE CVE-2019-3823 page https://www.suse.com/security/cve/CVE-2019-5435/ SUSE CVE CVE-2019-5435 page https://www.suse.com/security/cve/CVE-2019-5436/ SUSE CVE CVE-2019-5436 page https://www.suse.com/security/cve/CVE-2019-5481/ SUSE CVE CVE-2019-5481 page https://www.suse.com/security/cve/CVE-2019-5482/ SUSE CVE CVE-2019-5482 page https://www.suse.com/security/cve/CVE-2020-8169/ SUSE CVE CVE-2020-8169 page https://www.suse.com/security/cve/CVE-2020-8231/ SUSE CVE CVE-2020-8231 page https://www.suse.com/security/cve/CVE-2020-8284/ SUSE CVE CVE-2020-8284 page https://www.suse.com/security/cve/CVE-2020-8285/ SUSE CVE CVE-2020-8285 page https://www.suse.com/security/cve/CVE-2020-8286/ SUSE CVE CVE-2020-8286 page https://www.suse.com/security/cve/CVE-2021-22297/ SUSE CVE CVE-2021-22297 page https://www.suse.com/security/cve/CVE-2021-22298/ SUSE CVE CVE-2021-22298 page https://www.suse.com/security/cve/CVE-2021-22876/ SUSE CVE CVE-2021-22876 page https://www.suse.com/security/cve/CVE-2021-22890/ SUSE CVE CVE-2021-22890 page https://www.suse.com/security/cve/CVE-2021-22898/ SUSE CVE CVE-2021-22898 page https://www.suse.com/security/cve/CVE-2021-22901/ SUSE CVE CVE-2021-22901 page https://www.suse.com/security/cve/CVE-2021-22922/ SUSE CVE CVE-2021-22922 page https://www.suse.com/security/cve/CVE-2021-22924/ SUSE CVE CVE-2021-22924 page https://www.suse.com/security/cve/CVE-2021-22945/ SUSE CVE CVE-2021-22945 page https://www.suse.com/security/cve/CVE-2021-22946/ SUSE CVE CVE-2021-22946 page https://www.suse.com/security/cve/CVE-2021-22947/ SUSE CVE CVE-2021-22947 page openSUSE Tumbleweed curl-7.79.1-1.1 libcurl-devel-7.79.1-1.1 libcurl-devel-32bit-7.79.1-1.1 libcurl4-7.79.1-1.1 libcurl4-32bit-7.79.1-1.1 curl-7.79.1-1.1 as a component of openSUSE Tumbleweed libcurl-devel-7.79.1-1.1 as a component of openSUSE Tumbleweed libcurl-devel-32bit-7.79.1-1.1 as a component of openSUSE Tumbleweed libcurl4-7.79.1-1.1 as a component of openSUSE Tumbleweed libcurl4-32bit-7.79.1-1.1 as a component of openSUSE Tumbleweed Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL (tftp://) with a valid hostname and a long path. CVE-2006-1061 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2006-1061.html CVE-2006-1061 https://bugzilla.suse.com/157874 SUSE Bug 157874 curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks. CVE-2016-9586 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 1.2 AV:L/AC:H/Au:N/C:N/I:N/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9586.html CVE-2016-9586 https://bugzilla.suse.com/1015332 SUSE Bug 1015332 curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. Having a weak or virtually non-existent random value makes the operations that use it vulnerable. CVE-2016-9594 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9594.html CVE-2016-9594 https://bugzilla.suse.com/1016738 SUSE Bug 1016738 https://bugzilla.suse.com/1017161 SUSE Bug 1017161 https://bugzilla.suse.com/1042181 SUSE Bug 1042181 When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this would send the wrong buffer to the user (stdout or the application's provide callback), which could lead to other private data from the heap to get inadvertently displayed. The wrong buffer was an uninitialized memory area allocated on the heap and if it turned out to not contain any zero byte, it would continue and display the data following that buffer in memory. CVE-2017-1000099 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-1000099.html CVE-2017-1000099 https://bugzilla.suse.com/1051645 SUSE Bug 1051645 https://bugzilla.suse.com/1053919 SUSE Bug 1053919 When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS. CVE-2017-1000100 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 low 1.5 AV:L/AC:M/Au:S/C:P/I:N/A:N 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-1000100.html CVE-2017-1000100 https://bugzilla.suse.com/1051644 SUSE Bug 1051644 curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`. CVE-2017-1000101 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-1000101.html CVE-2017-1000101 https://bugzilla.suse.com/1051643 SUSE Bug 1051643 libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote. CVE-2017-1000254 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 low 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-1000254.html CVE-2017-1000254 https://bugzilla.suse.com/1061876 SUSE Bug 1061876 An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded. CVE-2017-1000257 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 4 AV:N/AC:H/Au:N/C:N/I:P/A:P 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-1000257.html CVE-2017-1000257 https://bugzilla.suse.com/1063824 SUSE Bug 1063824 curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status). CVE-2017-2629 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N 4 AV:N/AC:L/Au:S/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-2629.html CVE-2017-2629 https://bugzilla.suse.com/1025379 SUSE Bug 1025379 https://bugzilla.suse.com/1042181 SUSE Bug 1042181 In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range. CVE-2017-7468 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 2.1 AV:N/AC:H/Au:S/C:P/I:N/A:N 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-7468.html CVE-2017-7468 https://bugzilla.suse.com/1033413 SUSE Bug 1033413 https://bugzilla.suse.com/1033442 SUSE Bug 1033442 https://bugzilla.suse.com/1042181 SUSE Bug 1042181 https://bugzilla.suse.com/991389 SUSE Bug 991389 The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields. CVE-2017-8816 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-8816.html CVE-2017-8816 https://bugzilla.suse.com/1069226 SUSE Bug 1069226 https://bugzilla.suse.com/1106019 SUSE Bug 1106019 The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character. CVE-2017-8817 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 4 AV:N/AC:H/Au:N/C:P/I:P/A:N 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-8817.html CVE-2017-8817 https://bugzilla.suse.com/1069222 SUSE Bug 1069222 curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library. CVE-2017-8818 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-8818.html CVE-2017-8818 https://bugzilla.suse.com/1069714 SUSE Bug 1069714 In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use when given a URL without a scheme part, had a flaw that could lead to it overwriting a heap based memory buffer with seven bytes. If the default protocol is specified to be FILE or a file: URL lacks two slashes, the given "URL" starts with a drive letter, and libcurl is built for Windows or DOS, then libcurl would copy the path 7 bytes off, so that the end of the given path would write beyond the malloc buffer (7 bytes being the length in bytes of the ascii string "file://"). CVE-2017-9502 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-9502.html CVE-2017-9502 https://bugzilla.suse.com/1044243 SUSE Bug 1044243 Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value). CVE-2018-0500 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-0500.html CVE-2018-0500 https://bugzilla.suse.com/1099793 SUSE Bug 1099793 libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `:` to the target buffer, while this was recently changed to `: ` (a space was added after the colon) but the following math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something. CVE-2018-1000005 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-1000005.html CVE-2018-1000005 https://bugzilla.suse.com/1076360 SUSE Bug 1076360 A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse. CVE-2018-1000120 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-1000120.html CVE-2018-1000120 https://bugzilla.suse.com/1084521 SUSE Bug 1084521 https://bugzilla.suse.com/1101811 SUSE Bug 1101811 https://bugzilla.suse.com/1112526 SUSE Bug 1112526 A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage CVE-2018-1000122 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-1000122.html CVE-2018-1000122 https://bugzilla.suse.com/1084532 SUSE Bug 1084532 https://bugzilla.suse.com/1101811 SUSE Bug 1101811 https://bugzilla.suse.com/1112526 SUSE Bug 1112526 curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This vulnerability appears to have been fixed in curl < 7.54.1 and curl >= 7.60.0. CVE-2018-1000300 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-1000300.html CVE-2018-1000300 https://bugzilla.suse.com/1092094 SUSE Bug 1092094 curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0. CVE-2018-1000301 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 critical 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-1000301.html CVE-2018-1000301 https://bugzilla.suse.com/1092098 SUSE Bug 1092098 https://bugzilla.suse.com/1122464 SUSE Bug 1122464 curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.) CVE-2018-14618 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14618.html CVE-2018-14618 https://bugzilla.suse.com/1106019 SUSE Bug 1106019 https://bugzilla.suse.com/1112758 SUSE Bug 1112758 https://bugzilla.suse.com/1122464 SUSE Bug 1122464 Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service. CVE-2018-16839 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16839.html CVE-2018-16839 https://bugzilla.suse.com/1112758 SUSE Bug 1112758 https://bugzilla.suse.com/1113029 SUSE Bug 1113029 https://bugzilla.suse.com/1131886 SUSE Bug 1131886 A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. CVE-2018-16840 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16840.html CVE-2018-16840 https://bugzilla.suse.com/1112758 SUSE Bug 1112758 https://bugzilla.suse.com/1113029 SUSE Bug 1113029 https://bugzilla.suse.com/1122464 SUSE Bug 1122464 Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service. CVE-2018-16842 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16842.html CVE-2018-16842 https://bugzilla.suse.com/1113660 SUSE Bug 1113660 https://bugzilla.suse.com/1122464 SUSE Bug 1122464 libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds. CVE-2018-16890 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 low 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16890.html CVE-2018-16890 https://bugzilla.suse.com/1123371 SUSE Bug 1123371 https://bugzilla.suse.com/1123378 SUSE Bug 1123378 https://bugzilla.suse.com/1141798 SUSE Bug 1141798 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. CVE-2019-15601 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-15601.html CVE-2019-15601 https://bugzilla.suse.com/1160301 SUSE Bug 1160301 libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header. CVE-2019-3822 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-3822.html CVE-2019-3822 https://bugzilla.suse.com/1123377 SUSE Bug 1123377 https://bugzilla.suse.com/1141798 SUSE Bug 1141798 libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller. CVE-2019-3823 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-3823.html CVE-2019-3823 https://bugzilla.suse.com/1123378 SUSE Bug 1123378 https://bugzilla.suse.com/1126909 SUSE Bug 1126909 https://bugzilla.suse.com/1141798 SUSE Bug 1141798 An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. CVE-2019-5435 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-5435.html CVE-2019-5435 https://bugzilla.suse.com/1135176 SUSE Bug 1135176 https://bugzilla.suse.com/1154162 SUSE Bug 1154162 A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. CVE-2019-5436 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 important 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-5436.html CVE-2019-5436 https://bugzilla.suse.com/1135170 SUSE Bug 1135170 https://bugzilla.suse.com/1149496 SUSE Bug 1149496 https://bugzilla.suse.com/1154162 SUSE Bug 1154162 https://bugzilla.suse.com/1167096 SUSE Bug 1167096 Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. CVE-2019-5481 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-5481.html CVE-2019-5481 https://bugzilla.suse.com/1149495 SUSE Bug 1149495 Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. CVE-2019-5482 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-5482.html CVE-2019-5482 https://bugzilla.suse.com/1149496 SUSE Bug 1149496 https://bugzilla.suse.com/1156634 SUSE Bug 1156634 curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s). CVE-2020-8169 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-8169.html CVE-2020-8169 https://bugzilla.suse.com/1173026 SUSE Bug 1173026 https://bugzilla.suse.com/1186108 SUSE Bug 1186108 Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data. CVE-2020-8231 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 low 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-8231.html CVE-2020-8231 https://bugzilla.suse.com/1175109 SUSE Bug 1175109 https://bugzilla.suse.com/1179399 SUSE Bug 1179399 https://bugzilla.suse.com/1186108 SUSE Bug 1186108 A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. CVE-2020-8284 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-8284.html CVE-2020-8284 https://bugzilla.suse.com/1179398 SUSE Bug 1179398 https://bugzilla.suse.com/1179399 SUSE Bug 1179399 https://bugzilla.suse.com/1186108 SUSE Bug 1186108 curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing. CVE-2020-8285 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-8285.html CVE-2020-8285 https://bugzilla.suse.com/1179399 SUSE Bug 1179399 https://bugzilla.suse.com/1186108 SUSE Bug 1186108 curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. CVE-2020-8286 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-8286.html CVE-2020-8286 https://bugzilla.suse.com/1179593 SUSE Bug 1179593 https://bugzilla.suse.com/1186108 SUSE Bug 1186108 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVE-2021-22297 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-22297.html CVE-2021-22297 There is a logic vulnerability in Huawei Gauss100 OLTP Product. An attacker with certain permissions could perform specific SQL statement to exploit this vulnerability. Due to insufficient security design, successful exploit can cause service abnormal. Affected product versions include: ManageOne versions 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, 6.5.1.SPC100.B050, 6.5.1.SPC101.B010, 6.5.1.SPC101.B040, 6.5.1.SPC200, 6.5.1.SPC200.B010, 6.5.1.SPC200.B030, 6.5.1.SPC200.B040, 6.5.1.SPC200.B050, 6.5.1.SPC200.B060, 6.5.1.SPC200.B070, 6.5.1RC1.B070, 6.5.1RC1.B080, 6.5.1RC2.B040, 6.5.1RC2.B050, 6.5.1RC2.B060, 6.5.1RC2.B070, 6.5.1RC2.B080, 6.5.1RC2.B090. CVE-2021-22298 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 4 AV:N/AC:L/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-22298.html CVE-2021-22298 curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request. CVE-2021-22876 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-22876.html CVE-2021-22876 https://bugzilla.suse.com/1183933 SUSE Bug 1183933 curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check. CVE-2021-22890 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 low 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-22890.html CVE-2021-22890 https://bugzilla.suse.com/1183934 SUSE Bug 1183934 curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol. CVE-2021-22898 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-22898.html CVE-2021-22898 https://bugzilla.suse.com/1186114 SUSE Bug 1186114 https://bugzilla.suse.com/1192450 SUSE Bug 1192450 curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory. CVE-2021-22901 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-22901.html CVE-2021-22901 https://bugzilla.suse.com/1186115 SUSE Bug 1186115 https://bugzilla.suse.com/1188549 SUSE Bug 1188549 When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk. CVE-2021-22922 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-22922.html CVE-2021-22922 https://bugzilla.suse.com/1188217 SUSE Bug 1188217 https://bugzilla.suse.com/1192447 SUSE Bug 1192447 libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate. CVE-2021-22924 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-22924.html CVE-2021-22924 https://bugzilla.suse.com/1188219 SUSE Bug 1188219 https://bugzilla.suse.com/1192447 SUSE Bug 1192447 https://bugzilla.suse.com/1200196 SUSE Bug 1200196 When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*. CVE-2021-22945 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-22945.html CVE-2021-22945 https://bugzilla.suse.com/1190213 SUSE Bug 1190213 A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network. CVE-2021-22946 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-22946.html CVE-2021-22946 https://bugzilla.suse.com/1190373 SUSE Bug 1190373 https://bugzilla.suse.com/1194948 SUSE Bug 1194948 When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server. CVE-2021-22947 openSUSE Tumbleweed:curl-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl-devel-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-32bit-7.79.1-1.1 openSUSE Tumbleweed:libcurl4-7.79.1-1.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-22947.html CVE-2021-22947 https://bugzilla.suse.com/1190374 SUSE Bug 1190374