Date: Tue, 09 Mar 2010 15:18:34 +0100 From: Jan Lieskovsky <jlieskov@...hat.com> To: oss-security@...ts.openwall.com CC: "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: CVE Request -- cURL/libCURL 7.20.0 Hi Steve, Jan Lieskovsky wrote: > Hi Steve, vendors, > > cURL upstream has released latest v7.20.0 version of cURL/libCURL > fixing the "libcurl data callback excessive length" issue. > > References: >  http://curl.haxx.se/docs/security.html#20100209 >  http://curl.haxx.se/docs/adv_20100209.html >  http://curl.haxx.se/libcurl-contentencoding.patch >  http://curl.haxx.se/download.html > > Mitigation factors (from ): > > "This error is only present in zlib-enabled builds of libcurl and only if > automatic decompression has been explicitly enabled by the application > - it > is disabled by default." > > Could you allocate CVE id for this? Any update with assigning CVE id for this? Thanks, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team > > Thanks && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ