Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 16 Mar 2010 11:40:07 -0600
From: Vincent Danen <>
Cc: "Steven M. Christey" <>
Subject: Re: CVE Request -- cURL/libCURL 7.20.0

>Hi Steve, vendors,
>   cURL upstream has released latest v7.20.0 version of cURL/libCURL
>fixing the "libcurl data callback excessive length" issue.
>Mitigation factors (from [1]):
>"This error is only present in zlib-enabled builds of libcurl and only if
>  automatic decompression has been explicitly enabled by the application - it
>  is disabled by default."
>Could you allocate CVE id for this?

Please use CVE-2010-0734 for this issue.

Vincent Danen / Red Hat Security Response Team 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ