Test Kennung:	1.3.6.1.4.1.25623.1.0.852067
Kategorie:	SuSE Local Security Checks
Titel:	openSUSE: Security Advisory for curl (openSUSE-SU-2018:1624-1)
Zusammenfassung:	The remote host is missing an update for the 'curl'; package(s) announced via the openSUSE-SU-2018:1624-1 advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'curl' package(s) announced via the openSUSE-SU-2018:1624-1 advisory. Vulnerability Insight: This update for curl to version 7.60.0 fixes the following issues: These security issues were fixed: - CVE-2018-1000300: Prevent heap-based buffer overflow when closing down an FTP connection with very long server command replies (bsc#1092094). - CVE-2018-1000301: Prevent buffer over-read that could have cause reading data beyond the end of a heap based buffer used to store downloaded RTSP content (bsc#1092098). These non-security issues were fixed: - Add CURLOPT_HAPROXYPROTOCOL, support for the HAProxy PROXY protocol - Add --haproxy-protocol for the command line tool - Add CURLOPT_DNS_SHUFFLE_ADDRESSES, shuffle returned IP addresses - FTP: fix typo in recursive callback detection for seeking - test1208: marked flaky - HTTP: make header-less responses still count correct body size - user-agent.d:: mention --proxy-header as well - http2: fixes typo - cleanup: misc typos in strings and comments - rate-limit: use three second window to better handle high speeds - examples/hiperfifo.c: improved - pause: when changing pause state, update socket state - curl_version_info.3: fix ssl_version description - add_handle/easy_perform: clear errorbuffer on start if set - cmake: add support for brotli - parsedate: support UT timezone - vauth/ntlm.h: fix the #ifdef header guard - lib/curl_path.h: added #ifdef header guard - vauth/cleartext: fix integer overflow check - CURLINFO_COOKIELIST.3: made the example not leak memory - cookie.d: mention that '-' as filename means stdin - CURLINFO_SSL_VERIFYRESULT.3: fixed the example - http2: read pending frames (including GOAWAY) in connection-check - timeval: remove compilation warning by casting - cmake: avoid warn-as-error during config checks - travis-ci: enable -Werror for CMake builds - openldap: fix for NULL return from ldap_get_attribute_ber() - threaded resolver: track resolver time and set suitable timeout values - cmake: Add advapi32 as explicit link library for win32 - docs: fix CURLINFO_*_T examples use of CURL_FORMAT_CURL_OFF_T - test1148: set a fixed locale for the test - cookies: when reading from a file, only remove_expired once - cookie: store cookies per top-level-domain-specific hash table - openssl: RESTORED verify locations when verifypeer==0 - file: restore old behavior for file:////foo/bar URLs - FTP: allow PASV on IPv6 connections when a proxy is being used - build-openssl.bat: allow custom paths for VS and perl - winbuild: make the clean target work without build-type - build-openssl.bat: Refer to VS2017 as VC14.1 instead of VC15 - curl: r ... Description truncated, please see the referenced URL(s) for more information. Affected Software/OS: curl on openSUSE Leap 15.0. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2018-1000300 Common Vulnerability Exposure (CVE) ID: CVE-2018-1000301
Copyright	Copyright (C) 2018 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.