ALT-BU-2018-3545-1
Branch sisyphus update bulletin.
Closed bugs
gtk-интерфейс
Closed vulnerabilities
BDU:2018-01586
Уязвимость функции Curl_auth_create_plain_message программного средства для взаимодействия с серверами cURL, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-00963
Уязвимость функции vout программного средства для взаимодействия с серверами curl, позволяющая нарушителю раскрыть защищаемую информацию и вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2018-16839
Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.
- 1042012
- 1042012
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16839
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16839
- https://curl.haxx.se/docs/CVE-2018-16839.html
- https://curl.haxx.se/docs/CVE-2018-16839.html
- https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5
- https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5
- [infra-devnull] 20190404 [GitHub] [incubator-openwhisk-runtime-ballerina] falkzoll commented on issue #15: Update to new base image jdk8u202-b08_openj9-0.12.1.
- [infra-devnull] 20190404 [GitHub] [incubator-openwhisk-runtime-ballerina] falkzoll commented on issue #15: Update to new base image jdk8u202-b08_openj9-0.12.1.
- [debian-lts-announce] 20181106 [SECURITY] [DLA 1568-1] curl security update
- [debian-lts-announce] 20181106 [SECURITY] [DLA 1568-1] curl security update
- GLSA-201903-03
- GLSA-201903-03
- USN-3805-1
- USN-3805-1
- DSA-4331
- DSA-4331
Modified: 2024-11-21
CVE-2018-16840
A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.
- 1042013
- 1042013
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16840
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16840
- https://curl.haxx.se/docs/CVE-2018-16840.html
- https://curl.haxx.se/docs/CVE-2018-16840.html
- https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f
- https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f
- GLSA-201903-03
- GLSA-201903-03
- USN-3805-1
- USN-3805-1
Modified: 2024-11-21
CVE-2018-16842
Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.
- 1042014
- 1042014
- RHSA-2019:2181
- RHSA-2019:2181
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16842
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16842
- https://curl.haxx.se/docs/CVE-2018-16842.html
- https://curl.haxx.se/docs/CVE-2018-16842.html
- https://github.com/curl/curl/commit/d530e92f59ae9bb2d47066c3c460b25d2ffeb211
- https://github.com/curl/curl/commit/d530e92f59ae9bb2d47066c3c460b25d2ffeb211
- [debian-lts-announce] 20181106 [SECURITY] [DLA 1568-1] curl security update
- [debian-lts-announce] 20181106 [SECURITY] [DLA 1568-1] curl security update
- GLSA-201903-03
- GLSA-201903-03
- USN-3805-1
- USN-3805-1
- USN-3805-2
- USN-3805-2
- DSA-4331
- DSA-4331
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html