Ubuntu Security Notice 3710-1 - Peter Wu discovered that curl incorrectly handled certain SMTP buffers. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code.
80a2b90af8e17bbed5256e4745e44fc313b6f24d80e3fba89089ca8b34392848
==========================================================================
Ubuntu Security Notice USN-3710-1
July 11, 2018
curl vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 17.10
Summary:
curl could be made to crash or run programs if it received specially
crafted network traffic.
Software Description:
- curl: HTTP, HTTPS, and FTP client and client libraries
Details:
Peter Wu discovered that curl incorrectly handled certain SMTP buffers. A
remote attacker could use this issue to cause curl to crash, resulting in a
denial of service, or possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
curl 7.58.0-2ubuntu3.2
libcurl3-gnutls 7.58.0-2ubuntu3.2
libcurl3-nss 7.58.0-2ubuntu3.2
libcurl4 7.58.0-2ubuntu3.2
Ubuntu 17.10:
curl 7.55.1-1ubuntu2.6
libcurl3 7.55.1-1ubuntu2.6
libcurl3-gnutls 7.55.1-1ubuntu2.6
libcurl3-nss 7.55.1-1ubuntu2.6
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3710-1
CVE-2018-0500
Package Information:
https://launchpad.net/ubuntu/+source/curl/7.58.0-2ubuntu3.2
https://launchpad.net/ubuntu/+source/curl/7.55.1-1ubuntu2.6