From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1S4ioH-0004Bj-0u for garchives@archives.gentoo.org; Tue, 06 Mar 2012 01:03:25 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 5636EE0663; Tue, 6 Mar 2012 01:03:15 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) by pigeon.gentoo.org (Postfix) with ESMTP id 11C02E0663 for ; Tue, 6 Mar 2012 01:03:14 +0000 (UTC) Received: from flycatcher.gentoo.org (flycatcher.gentoo.org [81.93.255.6]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 46B761B4008 for ; Tue, 6 Mar 2012 01:03:14 +0000 (UTC) Received: by flycatcher.gentoo.org (Postfix, from userid 2316) id 214902004B; Tue, 6 Mar 2012 01:03:13 +0000 (UTC) From: "Sean Amoss (ackle)" To: gentoo-commits@lists.gentoo.org Reply-To: gentoo-dev@lists.gentoo.org, ackle@gentoo.org Subject: [gentoo-commits] gentoo commit in xml/htdocs/security/en/glsa: glsa-201203-02.xml X-VCS-Repository: gentoo X-VCS-Files: glsa-201203-02.xml X-VCS-Directories: xml/htdocs/security/en/glsa X-VCS-Committer: ackle X-VCS-Committer-Name: Sean Amoss Content-Type: text/plain; charset=utf8 Message-Id: <20120306010313.214902004B@flycatcher.gentoo.org> Date: Tue, 6 Mar 2012 01:03:13 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: quoted-printable X-Archives-Salt: cc2e05eb-4f72-4c6f-ae0d-5de0f248b075 X-Archives-Hash: 74c64a5e823f967cc995cb4ac3bc33fa ackle 12/03/06 01:03:13 Added: glsa-201203-02.xml Log: GLSA 201203-02 Revision Changes Path 1.1 xml/htdocs/security/en/glsa/glsa-201203-02.xml file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/security/en= /glsa/glsa-201203-02.xml?rev=3D1.1&view=3Dmarkup plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/security/en= /glsa/glsa-201203-02.xml?rev=3D1.1&content-type=3Dtext/plain Index: glsa-201203-02.xml =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D cURL: Multiple vulnerabilities Multiple vulnerabilities have been found in cURL, the worst o= f which might allow remote execution of arbitrary code. cURL March 06, 2012 March 06, 2012: 1 308645 373235 400799 remote 7.24.0 7.24.0

cURL is a command line tool for transferring files with URL syntax= , supporting numerous protocols.

Multiple vulnerabilities have been found in cURL:

=20
  • When zlib is enabled, the amount of data sent to an application= for automatic decompression is not restricted (CVE-2010-0734).
  • When performing GSSAPI authentication, credential delegation is always used (CVE-2011-2192).
  • When SSL is enabled, cURL improperly disables the OpenSSL worka= round to mitigate an information disclosure vulnerability in the SSL an= d TLS protocols (CVE-2011-3389).
  • libcurl does not properly verify file paths for escape control characters in IMAP, POP3 or SMTP URLs (CVE-2012-0036).=20

A remote attacker could entice a user or automated process to open= a specially crafted file or URL using cURL, possibly resulting in the remote execution of arbitrary code, a Denial of Service condition, disclosure of sensitive information, or unwanted actions performed = via the IMAP, POP3 or SMTP protocols. Furthermore, remote servers may b= e able to impersonate clients via GSSAPI requests.

There is no known workaround at this time.

All cURL users should upgrade to the latest version:

=20 # emerge --sync # emerge --ask --oneshot --verbose ">=3Dnet-misc/curl-7.24.0" =20 CVE= -2010-0734 CVE= -2011-2192 CVE= -2011-3389 CVE= -2012-0036 underling ackle