Security update for curl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:2381-1 Final 1 1 2019-09-16T13:18:33Z current 2019-09-16T13:18:33Z 2019-09-16T13:18:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for curl This update for curl fixes the following issues: Security issues fixed: - CVE-2019-5481: Fixed a double-free during kerberos FTP data transfer. (bsc#1149495) - CVE-2019-5482: Fixed a TFTP small block size heap buffer overflow (bsc#1149496). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sles12sp4:latest-2019-2381,Image SLES12-SP4-Azure-BYOS-2019-2381,Image SLES12-SP4-EC2-HVM-BYOS-2019-2381,Image SLES12-SP4-GCE-BYOS-2019-2381,Image SLES12-SP4-OCI-BYOS-2019-2381,Image SLES12-SP4-SAP-Azure-2019-2381,Image SLES12-SP4-SAP-Azure-BYOS-2019-2381,Image SLES12-SP4-SAP-Azure-LI-BYOS-Production-2019-2381,Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production-2019-2381,Image SLES12-SP4-SAP-EC2-HVM-2019-2381,Image SLES12-SP4-SAP-EC2-HVM-BYOS-2019-2381,Image SLES12-SP4-SAP-GCE-2019-2381,Image SLES12-SP4-SAP-GCE-BYOS-2019-2381,Image SLES12-SP4-SAP-OCI-BYOS-2019-2381,SUSE-2019-2381,SUSE-SLE-DESKTOP-12-SP4-2019-2381,SUSE-SLE-SDK-12-SP4-2019-2381,SUSE-SLE-SERVER-12-SP4-2019-2381 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20192381-1/ Link for SUSE-SU-2019:2381-1 https://lists.suse.com/pipermail/sle-security-updates/2019-September/005919.html E-Mail link for SUSE-SU-2019:2381-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1149495 SUSE Bug 1149495 https://bugzilla.suse.com/1149496 SUSE Bug 1149496 https://www.suse.com/security/cve/CVE-2019-5481/ SUSE CVE CVE-2019-5481 page https://www.suse.com/security/cve/CVE-2019-5482/ SUSE CVE CVE-2019-5482 page Container suse/sles12sp4:latest Image SLES12-SP4-Azure-BYOS Image SLES12-SP4-EC2-HVM-BYOS Image SLES12-SP4-GCE-BYOS Image SLES12-SP4-OCI-BYOS Image SLES12-SP4-SAP-Azure Image SLES12-SP4-SAP-Azure-BYOS Image SLES12-SP4-SAP-Azure-LI-BYOS-Production Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production Image SLES12-SP4-SAP-EC2-HVM Image SLES12-SP4-SAP-EC2-HVM-BYOS Image SLES12-SP4-SAP-GCE Image SLES12-SP4-SAP-GCE-BYOS Image SLES12-SP4-SAP-OCI-BYOS SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP4 libcurl4-7.60.0-4.9.1 curl-7.60.0-4.9.1 curl-mini-7.60.0-4.9.1 libcurl-devel-7.60.0-4.9.1 libcurl-devel-32bit-7.60.0-4.9.1 libcurl-devel-64bit-7.60.0-4.9.1 libcurl-mini-devel-7.60.0-4.9.1 libcurl4-32bit-7.60.0-4.9.1 libcurl4-64bit-7.60.0-4.9.1 libcurl4-mini-7.60.0-4.9.1 libcurl4-7.60.0-4.9.1 as a component of Container suse/sles12sp4:latest curl-7.60.0-4.9.1 as a component of Image SLES12-SP4-Azure-BYOS libcurl4-7.60.0-4.9.1 as a component of Image SLES12-SP4-Azure-BYOS curl-7.60.0-4.9.1 as a component of Image SLES12-SP4-EC2-HVM-BYOS libcurl4-7.60.0-4.9.1 as a component of Image SLES12-SP4-EC2-HVM-BYOS curl-7.60.0-4.9.1 as a component of Image SLES12-SP4-GCE-BYOS libcurl4-7.60.0-4.9.1 as a component of Image SLES12-SP4-GCE-BYOS curl-7.60.0-4.9.1 as a component of Image SLES12-SP4-OCI-BYOS libcurl4-7.60.0-4.9.1 as a component of Image SLES12-SP4-OCI-BYOS curl-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-Azure libcurl4-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-Azure curl-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-Azure-BYOS libcurl4-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-Azure-BYOS curl-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-Azure-LI-BYOS-Production libcurl4-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-Azure-LI-BYOS-Production curl-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production libcurl4-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production curl-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-EC2-HVM libcurl4-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-EC2-HVM curl-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-EC2-HVM-BYOS libcurl4-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-EC2-HVM-BYOS curl-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-GCE libcurl4-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-GCE curl-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-GCE-BYOS libcurl4-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-GCE-BYOS curl-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-OCI-BYOS libcurl4-7.60.0-4.9.1 as a component of Image SLES12-SP4-SAP-OCI-BYOS curl-7.60.0-4.9.1 as a component of SUSE Linux Enterprise Desktop 12 SP4 libcurl4-7.60.0-4.9.1 as a component of SUSE Linux Enterprise Desktop 12 SP4 libcurl4-32bit-7.60.0-4.9.1 as a component of SUSE Linux Enterprise Desktop 12 SP4 curl-7.60.0-4.9.1 as a component of SUSE Linux Enterprise Server 12 SP4 libcurl4-7.60.0-4.9.1 as a component of SUSE Linux Enterprise Server 12 SP4 libcurl4-32bit-7.60.0-4.9.1 as a component of SUSE Linux Enterprise Server 12 SP4 curl-7.60.0-4.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libcurl4-7.60.0-4.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libcurl4-32bit-7.60.0-4.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libcurl-devel-7.60.0-4.9.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. CVE-2019-5481 Container suse/sles12sp4:latest:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-Azure-BYOS:curl-7.60.0-4.9.1 Image SLES12-SP4-Azure-BYOS:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-EC2-HVM-BYOS:curl-7.60.0-4.9.1 Image SLES12-SP4-EC2-HVM-BYOS:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-GCE-BYOS:curl-7.60.0-4.9.1 Image SLES12-SP4-GCE-BYOS:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-OCI-BYOS:curl-7.60.0-4.9.1 Image SLES12-SP4-OCI-BYOS:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-Azure-BYOS:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-Azure-BYOS:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-Azure:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-Azure:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-EC2-HVM-BYOS:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-EC2-HVM-BYOS:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-EC2-HVM:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-EC2-HVM:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-GCE-BYOS:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-GCE-BYOS:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-GCE:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-GCE:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-OCI-BYOS:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-OCI-BYOS:libcurl4-7.60.0-4.9.1 SUSE Linux Enterprise Desktop 12 SP4:curl-7.60.0-4.9.1 SUSE Linux Enterprise Desktop 12 SP4:libcurl4-32bit-7.60.0-4.9.1 SUSE Linux Enterprise Desktop 12 SP4:libcurl4-7.60.0-4.9.1 SUSE Linux Enterprise Server 12 SP4:curl-7.60.0-4.9.1 SUSE Linux Enterprise Server 12 SP4:libcurl4-32bit-7.60.0-4.9.1 SUSE Linux Enterprise Server 12 SP4:libcurl4-7.60.0-4.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:curl-7.60.0-4.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libcurl4-32bit-7.60.0-4.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libcurl4-7.60.0-4.9.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libcurl-devel-7.60.0-4.9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192381-1/ https://www.suse.com/security/cve/CVE-2019-5481.html CVE-2019-5481 https://bugzilla.suse.com/1149495 SUSE Bug 1149495 Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. CVE-2019-5482 Container suse/sles12sp4:latest:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-Azure-BYOS:curl-7.60.0-4.9.1 Image SLES12-SP4-Azure-BYOS:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-EC2-HVM-BYOS:curl-7.60.0-4.9.1 Image SLES12-SP4-EC2-HVM-BYOS:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-GCE-BYOS:curl-7.60.0-4.9.1 Image SLES12-SP4-GCE-BYOS:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-OCI-BYOS:curl-7.60.0-4.9.1 Image SLES12-SP4-OCI-BYOS:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-Azure-BYOS:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-Azure-BYOS:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-Azure:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-Azure:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-EC2-HVM-BYOS:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-EC2-HVM-BYOS:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-EC2-HVM:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-EC2-HVM:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-GCE-BYOS:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-GCE-BYOS:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-GCE:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-GCE:libcurl4-7.60.0-4.9.1 Image SLES12-SP4-SAP-OCI-BYOS:curl-7.60.0-4.9.1 Image SLES12-SP4-SAP-OCI-BYOS:libcurl4-7.60.0-4.9.1 SUSE Linux Enterprise Desktop 12 SP4:curl-7.60.0-4.9.1 SUSE Linux Enterprise Desktop 12 SP4:libcurl4-32bit-7.60.0-4.9.1 SUSE Linux Enterprise Desktop 12 SP4:libcurl4-7.60.0-4.9.1 SUSE Linux Enterprise Server 12 SP4:curl-7.60.0-4.9.1 SUSE Linux Enterprise Server 12 SP4:libcurl4-32bit-7.60.0-4.9.1 SUSE Linux Enterprise Server 12 SP4:libcurl4-7.60.0-4.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:curl-7.60.0-4.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libcurl4-32bit-7.60.0-4.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libcurl4-7.60.0-4.9.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libcurl-devel-7.60.0-4.9.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192381-1/ https://www.suse.com/security/cve/CVE-2019-5482.html CVE-2019-5482 https://bugzilla.suse.com/1149496 SUSE Bug 1149496 https://bugzilla.suse.com/1156634 SUSE Bug 1156634