FEDORA-2015-6728 — security update for curl

stable

curl-7.37.0-14.fc21

FEDORA-2015-6728 created by kdudka 9 years ago for Fedora 21

require credentials to match for NTLM re-use (CVE-2015-3143)
fix invalid write with a zero-length host name in URL (CVE-2015-3144)
fix invalid write in cookie path sanitization code (CVE-2015-3145)
close Negotiate connections when done (CVE-2015-3148)

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2015-6728

This update has been submitted for testing by kdudka.

9 years ago

taskotron commented 9 years ago

Taskotron: depcheck test PASSED on i386. Result log: https://taskotron.fedoraproject.org/taskmaster//builders/x86_64/builds/60971/steps/runtask/logs/stdio (results are informative only)

taskotron commented 9 years ago

Taskotron: depcheck test PASSED on x86_64. Result log: https://taskotron.fedoraproject.org/taskmaster//builders/x86_64/builds/60971/steps/runtask/logs/stdio (results are informative only)

This update is currently being pushed to the Fedora 21 testing updates repository.

9 years ago

This update has been pushed to testing

9 years ago

williamjmorenor commented & provided feedback 9 years ago

karma

Basic usage works

kparal commented & provided feedback 9 years ago

karma

very basic usage seems to work

Critical path update approved

9 years ago

yuwata provided feedback 9 years ago

karma

This update has reached the stable karma threshold and will be pushed to the stable updates repository

9 years ago

taskotron commented 9 years ago

Taskotron: upgradepath test PASSED on noarch. Result log: https://taskotron.fedoraproject.org/taskmaster//builders/x86_64/builds/64352/steps/runtask/logs/stdio (results are informative only)

kdudka commented 9 years ago

Thank you for testing the update!

This update is currently being pushed to the Fedora 21 stable updates repository.

9 years ago

This update has been pushed to stable

9 years ago

Please login to add feedback.

Metadata

Type

security

Karma

Signed

Content Type

RPM

Test Gating

None

Builds

curl-7.37.0-14.fc21

Settings

Unstable by Karma

-3

Stable by Karma

disabled

Stable by Time

disabled

Dates

submitted

9 years ago

in testing

9 years ago

in stable

9 years ago

BZ#1213306 CVE-2015-3143 curl: re-using authenticated connection when unauthenticated

BZ#1213335 CVE-2015-3144 curl: host name out of boundary memory access

BZ#1213347 CVE-2015-3145 curl: cookie parser out of boundary memory access

BZ#1213351 CVE-2015-3148 curl: Negotiate not treated as connection-oriented

BZ#1214181 CVE-2015-3144 curl: host name out of boundary memory access [fedora-all]

BZ#1214182 CVE-2015-3145 curl: cookie parser out of boundary memory access [fedora-all]

BZ#1214183 CVE-2015-3148 curl: "Negotiate" not treated as connection-oriented [fedora-all]

BZ#1214184 CVE-2015-3143 curl: re-using authenticated connection when unauthenticated [fedora-all]

curl-7.37.0-14.fc21

Automated Test Results

None