—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2015:021
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : curl
Date : January 12, 2015
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated curl packages fix security vulnerability:

When libcurl sends a request to a server via a HTTP proxy, it copies
the entire URL into the request and sends if off. If the given URL
contains line feeds and carriage returns those will be sent along to
the proxy too, which allows the program to for example send a separate
HTTP request injected embedded in the URL (CVE-2014-8150).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8150
http://advisories.mageia.org/MGASA-2015-0020.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
cbf237775c5e1ca9bb4682d51bd28556 mbs1/x86_64/curl-7.24.0-3.8.mbs1.x86_64.rpm
45f01de00df39d1b46f9e35172c38dbb mbs1/x86_64/curl-examples-7.24.0-3.8.mbs1.x86_64.rpm
574c629f73b354a3be90064f312b6c84 mbs1/x86_64/lib64curl4-7.24.0-3.8.mbs1.x86_64.rpm
46c44721804a2f0b9fa3734656505bc0 mbs1/x86_64/lib64curl-devel-7.24.0-3.8.mbs1.x86_64.rpm
b54588388c5e4a620672c871489e620a mbs1/SRPMS/curl-7.24.0-3.8.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFUs7CzmqjQ0CJFipgRAtoPAJ0dGoTpMEEe8qVIF6NHXa5zzmj4GQCgxxqM
IStoYE0u+k6e8Wj/8q4lxo0=
=bhc7
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________