sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] [SMGLSA-2006:12] curl: TFTP Packet Buffer Overflow Vulnerability

From: Ladislav Hagara <ladislav.hagara AT unob.cz>
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] [SMGLSA-2006:12] curl: TFTP Packet Buffer Overflow Vulnerability
Date: Mon, 20 Mar 2006 17:08:44 +0100 (CET)

libcurl uses the given file part of a TFTP URL in a manner that allows a malicious user to overflow a heap-based memory buffer due to the lack of boundary check.

For more info:
http://curl.haxx.se/docs/adv_20060320.html

-----
curl should be updated to version 7.15.3:

# scribe update
# cast -c curl

or

# scribe update
# sorcery queue-security
# cast --queue

--
Ladislav Hagara

[SM-Security] [SMGLSA-2006:12] curl: TFTP Packet Buffer Overflow Vulnerability, Ladislav Hagara, 03/20/2006