[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: [oss-security] Re: CVE Request -- cURL/libCURL 7.20.0
From: Vincent Danen <vdanen () redhat ! com>
Date: 2010-03-16 17:40:07
Message-ID: 20100316174007.GI30480 () redhat ! com
[Download RAW message or body]
>Hi Steve, vendors,
>
> cURL upstream has released latest v7.20.0 version of cURL/libCURL
>fixing the "libcurl data callback excessive length" issue.
>
>References:
>[1] http://curl.haxx.se/docs/security.html#20100209
>[2] http://curl.haxx.se/docs/adv_20100209.html
>[3] http://curl.haxx.se/libcurl-contentencoding.patch
>[4] http://curl.haxx.se/download.html
>
>Mitigation factors (from [1]):
>
>"This error is only present in zlib-enabled builds of libcurl and only if
> automatic decompression has been explicitly enabled by the application - it
> is disabled by default."
>
>Could you allocate CVE id for this?
Please use CVE-2010-0734 for this issue.
--
Vincent Danen / Red Hat Security Response Team
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic