Red Hat Security Advisory

RHSA-2020:1792

curl security update

Released 2020-04-28 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-12.el8, libcurl-7.61.1-12.el8, libcurl-devel-7.61.1-12.el8 +1

TI-2019-03845 CVE-2019-5436 · GHSA-8xvc-p9x4-w7jm

HIGH 67

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.49739 Published 2019-05-28 Partial fix CWE-122

TI-2019-03890 CVE-2019-5482 · GHSA-35cc-32cj-vr6g

HIGH 66

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.17939 Published 2019-09-16 Partial fix CWE-122

TI-2019-03889 CVE-2019-5481 · GHSA-hr98-frg6-wvvr

MEDIUM 59

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07465 Published 2019-09-16 Partial fix CWE-415