Security update for curl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0962-1 Final 1 1 2014-04-15T15:50:15Z current 2014-04-15T15:50:15Z 2014-04-15T15:50:15Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for curl This curl update fixes the following security issues: * bnc#868627: wrong re-use of connections (CVE-2014-0138). * bnc#868629: IP address wildcard certificate validation (CVE-2014-0139). * bnc#870444: --insecure option inappropriately enforcing security safeguard. Security Issue references: * CVE-2014-0138 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138> * CVE-2014-0139 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0139> The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp3-curl,sledsp3-curl,slessp3-curl Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150962-1/ Link for SUSE-SU-2015:0962-1 https://lists.suse.com/pipermail/sle-security-updates/2015-May/001414.html E-Mail link for SUSE-SU-2015:0962-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/824517 SUSE Bug 824517 https://bugzilla.suse.com/849596 SUSE Bug 849596 https://bugzilla.suse.com/858673 SUSE Bug 858673 https://bugzilla.suse.com/868627 SUSE Bug 868627 https://bugzilla.suse.com/868629 SUSE Bug 868629 https://bugzilla.suse.com/870444 SUSE Bug 870444 https://bugzilla.suse.com/927174 SUSE Bug 927174 https://bugzilla.suse.com/927556 SUSE Bug 927556 https://bugzilla.suse.com/927746 SUSE Bug 927746 https://bugzilla.suse.com/928533 SUSE Bug 928533 https://www.suse.com/security/cve/CVE-2013-2174/ SUSE CVE CVE-2013-2174 page https://www.suse.com/security/cve/CVE-2013-4545/ SUSE CVE CVE-2013-4545 page https://www.suse.com/security/cve/CVE-2014-0015/ SUSE CVE CVE-2014-0015 page https://www.suse.com/security/cve/CVE-2014-0138/ SUSE CVE CVE-2014-0138 page https://www.suse.com/security/cve/CVE-2014-0139/ SUSE CVE CVE-2014-0139 page https://www.suse.com/security/cve/CVE-2015-3143/ SUSE CVE CVE-2015-3143 page https://www.suse.com/security/cve/CVE-2015-3148/ SUSE CVE CVE-2015-3148 page https://www.suse.com/security/cve/CVE-2015-3153/ SUSE CVE CVE-2015-3153 page SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server for SAP Applications 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP3 libcurl-devel-7.19.7-1.38.1 curl-7.19.7-1.38.1 libcurl4-7.19.7-1.38.1 libcurl4-32bit-7.19.7-1.38.1 libcurl4-x86-7.19.7-1.38.1 curl-7.19.7-1.38.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 libcurl4-7.19.7-1.38.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 libcurl4-32bit-7.19.7-1.38.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 curl-7.19.7-1.38.1 as a component of SUSE Linux Enterprise Server 11 SP3 libcurl4-7.19.7-1.38.1 as a component of SUSE Linux Enterprise Server 11 SP3 libcurl4-32bit-7.19.7-1.38.1 as a component of SUSE Linux Enterprise Server 11 SP3 libcurl4-x86-7.19.7-1.38.1 as a component of SUSE Linux Enterprise Server 11 SP3 curl-7.19.7-1.38.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libcurl4-7.19.7-1.38.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libcurl4-32bit-7.19.7-1.38.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libcurl4-x86-7.19.7-1.38.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA curl-7.19.7-1.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 libcurl4-7.19.7-1.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 libcurl4-32bit-7.19.7-1.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 libcurl4-x86-7.19.7-1.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 libcurl-devel-7.19.7-1.38.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character. CVE-2013-2174 SUSE Linux Enterprise Desktop 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Desktop 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Desktop 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Software Development Kit 11 SP3:libcurl-devel-7.19.7-1.38.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150962-1/ https://www.suse.com/security/cve/CVE-2013-2174.html CVE-2013-2174 https://bugzilla.suse.com/824517 SUSE Bug 824517 https://bugzilla.suse.com/917692 SUSE Bug 917692 cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. CVE-2013-4545 SUSE Linux Enterprise Desktop 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Desktop 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Desktop 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Software Development Kit 11 SP3:libcurl-devel-7.19.7-1.38.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150962-1/ https://www.suse.com/security/cve/CVE-2013-4545.html CVE-2013-4545 https://bugzilla.suse.com/849596 SUSE Bug 849596 https://bugzilla.suse.com/870444 SUSE Bug 870444 https://bugzilla.suse.com/880252 SUSE Bug 880252 https://bugzilla.suse.com/882520 SUSE Bug 882520 https://bugzilla.suse.com/924250 SUSE Bug 924250 cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request. CVE-2014-0015 SUSE Linux Enterprise Desktop 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Desktop 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Desktop 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Software Development Kit 11 SP3:libcurl-devel-7.19.7-1.38.1 moderate 2.1 AV:N/AC:H/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150962-1/ https://www.suse.com/security/cve/CVE-2014-0015.html CVE-2014-0015 https://bugzilla.suse.com/858673 SUSE Bug 858673 https://bugzilla.suse.com/868627 SUSE Bug 868627 https://bugzilla.suse.com/880252 SUSE Bug 880252 https://bugzilla.suse.com/882520 SUSE Bug 882520 https://bugzilla.suse.com/927556 SUSE Bug 927556 https://bugzilla.suse.com/962983 SUSE Bug 962983 The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015. CVE-2014-0138 SUSE Linux Enterprise Desktop 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Desktop 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Desktop 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Software Development Kit 11 SP3:libcurl-devel-7.19.7-1.38.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150962-1/ https://www.suse.com/security/cve/CVE-2014-0138.html CVE-2014-0138 https://bugzilla.suse.com/868627 SUSE Bug 868627 https://bugzilla.suse.com/880252 SUSE Bug 880252 https://bugzilla.suse.com/882520 SUSE Bug 882520 cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. CVE-2014-0139 SUSE Linux Enterprise Desktop 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Desktop 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Desktop 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Software Development Kit 11 SP3:libcurl-devel-7.19.7-1.38.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150962-1/ https://www.suse.com/security/cve/CVE-2014-0139.html CVE-2014-0139 https://bugzilla.suse.com/868629 SUSE Bug 868629 https://bugzilla.suse.com/880252 SUSE Bug 880252 https://bugzilla.suse.com/882520 SUSE Bug 882520 cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015. CVE-2015-3143 SUSE Linux Enterprise Desktop 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Desktop 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Desktop 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Software Development Kit 11 SP3:libcurl-devel-7.19.7-1.38.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150962-1/ https://www.suse.com/security/cve/CVE-2015-3143.html CVE-2015-3143 https://bugzilla.suse.com/927556 SUSE Bug 927556 cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request. CVE-2015-3148 SUSE Linux Enterprise Desktop 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Desktop 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Desktop 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Software Development Kit 11 SP3:libcurl-devel-7.19.7-1.38.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150962-1/ https://www.suse.com/security/cve/CVE-2015-3148.html CVE-2015-3148 https://bugzilla.suse.com/1092962 SUSE Bug 1092962 https://bugzilla.suse.com/927746 SUSE Bug 927746 The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents. CVE-2015-3153 SUSE Linux Enterprise Desktop 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Desktop 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Desktop 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server 11 SP3:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:curl-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-32bit-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-7.19.7-1.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libcurl4-x86-7.19.7-1.38.1 SUSE Linux Enterprise Software Development Kit 11 SP3:libcurl-devel-7.19.7-1.38.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150962-1/ https://www.suse.com/security/cve/CVE-2015-3153.html CVE-2015-3153 https://bugzilla.suse.com/928533 SUSE Bug 928533 https://bugzilla.suse.com/951391 SUSE Bug 951391