Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 09 Mar 2010 15:18:34 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request -- cURL/libCURL 7.20.0

Hi Steve,

Jan Lieskovsky wrote:
> Hi Steve, vendors,
> 
>   cURL upstream has released latest v7.20.0 version of cURL/libCURL
> fixing the "libcurl data callback excessive length" issue.
> 
> References:
> [1] http://curl.haxx.se/docs/security.html#20100209
> [2] http://curl.haxx.se/docs/adv_20100209.html
> [3] http://curl.haxx.se/libcurl-contentencoding.patch
> [4] http://curl.haxx.se/download.html
> 
> Mitigation factors (from [1]):
> 
> "This error is only present in zlib-enabled builds of libcurl and only if
>  automatic decompression has been explicitly enabled by the application 
> - it
>  is disabled by default."
> 
> Could you allocate CVE id for this?

   Any update with assigning CVE id for this?

Thanks, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

> 
> Thanks && Regards, Jan.
> -- 
> Jan iankko Lieskovsky / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ