Home / mailings [USN-2167-1] curl vulnerabilities
Posted on 14 April 2014
Ubuntu Security==========================
==========================
========================
Ubuntu Security Notice USN-2167-1
April 14, 2014
curl vulnerabilities
==========================
==========================
========================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 13.10
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in curl.
Software Description:
- curl: HTTP, HTTPS, and FTP client and client libraries
Details:
Steve Holme discovered that libcurl incorrectly reused wrong connections
when using protocols other than HTTP and FTP. This could lead to the use =
of
unintended credentials, possibly exposing sensitive information.
(CVE-2014-0138)
Richard Moore discovered that libcurl incorrectly validated wildcard SSL
certificates that contain literal IP addresses. An attacker could possibl=
y
exploit this to perform a man in the middle attack to view sensitive
information or alter encrypted communications. (CVE-2014-0139)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 13.10:
libcurl3 7.32.0-1ubuntu1.4
libcurl3-gnutls 7.32.0-1ubuntu1.4
libcurl3-nss 7.32.0-1ubuntu1.4
Ubuntu 12.10:
libcurl3 7.27.0-1ubuntu1.9
libcurl3-gnutls 7.27.0-1ubuntu1.9
libcurl3-nss 7.27.0-1ubuntu1.9
Ubuntu 12.04 LTS:
libcurl3 7.22.0-3ubuntu4.8
libcurl3-gnutls 7.22.0-3ubuntu4.8
libcurl3-nss 7.22.0-3ubuntu4.8
Ubuntu 10.04 LTS:
libcurl3 7.19.7-1ubuntu1.7
libcurl3-gnutls 7.19.7-1ubuntu1.7
In general, a standard system update will make all the necessary changes.=
References:
http://www.ubuntu.com/usn/usn-2167-1
CVE-2014-0138, CVE-2014-0139
Package Information:
https://launchpad.net/ubuntu/+source/curl/7.32.0-1ubuntu1.4
https://launchpad.net/ubuntu/+source/curl/7.27.0-1ubuntu1.9
https://launchpad.net/ubuntu/+source/curl/7.22.0-3ubuntu4.8
https://launchpad.net/ubuntu/+source/curl/7.19.7-1ubuntu1.7
