—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:187
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : curl
Date : September 25, 2014
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated curl packages fix security vulnerabilities:

In cURL before 7.38.0, libcurl can be fooled to both sending cookies
to wrong sites and into allowing arbitrary sites to set cookies for
others. For this problem to trigger, the client application must use
the numerical IP address in the URL to access the site (CVE-2014-3613).

In cURL before 7.38.0, libcurl wrongly allows cookies to be set for Top
Level Domains (TLDs), thus making them apply broader than cookies are
allowed. This can allow arbitrary sites to set cookies that then would
get sent to a different and unrelated site or domain (CVE-2014-3620).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3613
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3620
http://advisories.mageia.org/MGASA-2014-0385.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
536d4cd31d069a4fef2af0782b82f5aa mbs1/x86_64/curl-7.24.0-3.6.mbs1.x86_64.rpm
c637bcc4b71898f92995a1470a5f5768 mbs1/x86_64/curl-examples-7.24.0-3.6.mbs1.x86_64.rpm
c2a1ef105b155e503249526ccd3bb856 mbs1/x86_64/lib64curl4-7.24.0-3.6.mbs1.x86_64.rpm
bebb361f004e16d892fe8fec8660a932 mbs1/x86_64/lib64curl-devel-7.24.0-3.6.mbs1.x86_64.rpm
f7f91a987cdbdba0fddc396cf650c2a6 mbs1/SRPMS/curl-7.24.0-3.6.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFUI8I5mqjQ0CJFipgRApp6AKCV5Q/BGqCXvnBYVciEmjC1I/7AlQCfRJn0
vh4yFn0Qrh8fVxuacNmlJt4=
=OLl1
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________