Security update for curl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:1323-1 Final 1 1 2018-05-16T19:52:18Z current 2018-05-16T19:52:18Z 2018-05-16T19:52:18Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for curl This update for curl fixes the following issues: curl was updated to version 7.37.0 (fate#325339 bsc#1084137) This update syncs the curl version to the one in SUSE Linux Enterprise 12 and is full binary compatible to the previous version. This update is done to allow other third party software like 'R' to be able to be used on the SUSE Linux Enterprise 11 codebase. Following security issues were fixed: - CVE-2018-1000120: A buffer overflow exists in the FTP URL handling that allowed an attacker to cause a denial of service or possible code execution (bsc#1084521). - CVE-2018-1000121: A NULL pointer dereference exists in the LDAP code that allowed an attacker to cause a denial of service (bsc#1084524). - CVE-2018-1000122: A buffer over-read exists in the RTSP+RTP handling code that allowed an attacker to cause a denial of service or information leakage (bsc#1084532). The package also requires a libopenssl that implements the DEFAULT_SUSE cipher list (bsc#1081056, bsc#1083463,bsc#1086825) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-curl-13609,secsp3-curl-13609,sleposp3-curl-13609,slessp3-curl-13609,slessp4-curl-13609 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20181323-1/ Link for SUSE-SU-2018:1323-1 https://lists.suse.com/pipermail/sle-security-updates/2018-May/004059.html E-Mail link for SUSE-SU-2018:1323-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1081056 SUSE Bug 1081056 https://bugzilla.suse.com/1083463 SUSE Bug 1083463 https://bugzilla.suse.com/1084137 SUSE Bug 1084137 https://bugzilla.suse.com/1084521 SUSE Bug 1084521 https://bugzilla.suse.com/1084524 SUSE Bug 1084524 https://bugzilla.suse.com/1084532 SUSE Bug 1084532 https://bugzilla.suse.com/1085124 SUSE Bug 1085124 https://bugzilla.suse.com/1086825 SUSE Bug 1086825 https://bugzilla.suse.com/1087922 SUSE Bug 1087922 https://bugzilla.suse.com/1090194 SUSE Bug 1090194 https://www.suse.com/security/cve/CVE-2018-1000120/ SUSE CVE CVE-2018-1000120 page https://www.suse.com/security/cve/CVE-2018-1000121/ SUSE CVE CVE-2018-1000121 page https://www.suse.com/security/cve/CVE-2018-1000122/ SUSE CVE CVE-2018-1000122 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server 11-SECURITY SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 libcurl-devel-7.37.0-70.27.1 curl-openssl1-7.37.0-70.27.1 libcurl4-openssl1-7.37.0-70.27.1 libcurl4-openssl1-32bit-7.37.0-70.27.1 libcurl4-openssl1-x86-7.37.0-70.27.1 curl-7.37.0-70.27.1 libcurl4-7.37.0-70.27.1 libcurl4-32bit-7.37.0-70.27.1 libcurl4-x86-7.37.0-70.27.1 curl-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 libcurl4-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 curl-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS curl-openssl1-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS libcurl4-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS libcurl4-32bit-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS libcurl4-openssl1-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS libcurl4-openssl1-32bit-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS curl-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA curl-openssl1-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libcurl4-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libcurl4-32bit-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libcurl4-openssl1-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libcurl4-openssl1-32bit-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA curl-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11 SP4 libcurl4-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11 SP4 libcurl4-32bit-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11 SP4 libcurl4-x86-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11 SP4 curl-openssl1-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11-SECURITY libcurl4-openssl1-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11-SECURITY libcurl4-openssl1-32bit-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11-SECURITY libcurl4-openssl1-x86-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server 11-SECURITY curl-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libcurl4-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libcurl4-32bit-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libcurl4-x86-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libcurl-devel-7.37.0-70.27.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse. CVE-2018-1000120 SUSE Linux Enterprise Point of Sale 11 SP3:curl-7.37.0-70.27.1 SUSE Linux Enterprise Point of Sale 11 SP3:libcurl4-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:curl-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:curl-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-openssl1-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-openssl1-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP4:curl-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-x86-7.37.0-70.27.1 SUSE Linux Enterprise Server 11-SECURITY:curl-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-x86-7.37.0-70.27.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:curl-7.37.0-70.27.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-7.37.0-70.27.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-x86-7.37.0-70.27.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libcurl-devel-7.37.0-70.27.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181323-1/ https://www.suse.com/security/cve/CVE-2018-1000120.html CVE-2018-1000120 https://bugzilla.suse.com/1084521 SUSE Bug 1084521 https://bugzilla.suse.com/1101811 SUSE Bug 1101811 https://bugzilla.suse.com/1112526 SUSE Bug 1112526 A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service CVE-2018-1000121 SUSE Linux Enterprise Point of Sale 11 SP3:curl-7.37.0-70.27.1 SUSE Linux Enterprise Point of Sale 11 SP3:libcurl4-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:curl-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:curl-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-openssl1-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-openssl1-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP4:curl-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-x86-7.37.0-70.27.1 SUSE Linux Enterprise Server 11-SECURITY:curl-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-x86-7.37.0-70.27.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:curl-7.37.0-70.27.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-7.37.0-70.27.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-x86-7.37.0-70.27.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libcurl-devel-7.37.0-70.27.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181323-1/ https://www.suse.com/security/cve/CVE-2018-1000121.html CVE-2018-1000121 https://bugzilla.suse.com/1084524 SUSE Bug 1084524 https://bugzilla.suse.com/1085215 SUSE Bug 1085215 https://bugzilla.suse.com/1101811 SUSE Bug 1101811 https://bugzilla.suse.com/1112526 SUSE Bug 1112526 A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage CVE-2018-1000122 SUSE Linux Enterprise Point of Sale 11 SP3:curl-7.37.0-70.27.1 SUSE Linux Enterprise Point of Sale 11 SP3:libcurl4-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:curl-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:curl-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-openssl1-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-LTSS:libcurl4-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:curl-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-openssl1-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libcurl4-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP4:curl-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-7.37.0-70.27.1 SUSE Linux Enterprise Server 11 SP4:libcurl4-x86-7.37.0-70.27.1 SUSE Linux Enterprise Server 11-SECURITY:curl-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-7.37.0-70.27.1 SUSE Linux Enterprise Server 11-SECURITY:libcurl4-openssl1-x86-7.37.0-70.27.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:curl-7.37.0-70.27.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-32bit-7.37.0-70.27.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-7.37.0-70.27.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libcurl4-x86-7.37.0-70.27.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libcurl-devel-7.37.0-70.27.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181323-1/ https://www.suse.com/security/cve/CVE-2018-1000122.html CVE-2018-1000122 https://bugzilla.suse.com/1084532 SUSE Bug 1084532 https://bugzilla.suse.com/1101811 SUSE Bug 1101811 https://bugzilla.suse.com/1112526 SUSE Bug 1112526