oss-sec mailing list archives
Re: CVE Request -- cURL/libCURL 7.20.0
From: Vincent Danen <vdanen () redhat com>
Date: Tue, 16 Mar 2010 11:40:07 -0600
Hi Steve, vendors, cURL upstream has released latest v7.20.0 version of cURL/libCURL fixing the "libcurl data callback excessive length" issue. References: [1] http://curl.haxx.se/docs/security.html#20100209 [2] http://curl.haxx.se/docs/adv_20100209.html [3] http://curl.haxx.se/libcurl-contentencoding.patch [4] http://curl.haxx.se/download.html Mitigation factors (from [1]): "This error is only present in zlib-enabled builds of libcurl and only if automatic decompression has been explicitly enabled by the application - it is disabled by default." Could you allocate CVE id for this?
Please use CVE-2010-0734 for this issue. --Vincent Danen / Red Hat Security Response Team
Current thread:
- CVE Request -- cURL/libCURL 7.20.0 Jan Lieskovsky (Feb 09)
- Re: CVE Request -- cURL/libCURL 7.20.0 Jan Lieskovsky (Mar 09)
- <Possible follow-ups>
- Re: CVE Request -- cURL/libCURL 7.20.0 Vincent Danen (Mar 16)