Date: Tue, 09 Feb 2010 15:23:59 +0100 From: Jan Lieskovsky <jlieskov@...hat.com> To: oss-security <oss-security@...ts.openwall.com> CC: "Steven M. Christey" <coley@...us.mitre.org> Subject: CVE Request -- cURL/libCURL 7.20.0 Hi Steve, vendors, cURL upstream has released latest v7.20.0 version of cURL/libCURL fixing the "libcurl data callback excessive length" issue. References:  http://curl.haxx.se/docs/security.html#20100209  http://curl.haxx.se/docs/adv_20100209.html  http://curl.haxx.se/libcurl-contentencoding.patch  http://curl.haxx.se/download.html Mitigation factors (from ): "This error is only present in zlib-enabled builds of libcurl and only if automatic decompression has been explicitly enabled by the application - it is disabled by default." Could you allocate CVE id for this? Thanks && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ