==========================================================================
Ubuntu Security Notice USN-3598-1
March 15, 2018

curl vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 17.10
– Ubuntu 16.04 LTS
– Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in curl.

Software Description:
– curl: HTTP, HTTPS, and FTP client and client libraries

Details:

Phan Thanh discovered that curl incorrectly handled certain FTP paths. An
attacker could use this to cause a denial of service or possibly execute
arbitrary code. (CVE-2018-1000120)

Dario Weisser discovered that curl incorrectly handled certain LDAP URLs.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2018-1000121)

Max Dymond discovered that curl incorrectly handled certain RTSP data. An
attacker could possibly use this to cause a denial of service or even to
get access to sensitive data. (CVE-2018-1000122)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
curl 7.55.1-1ubuntu2.4
libcurl3 7.55.1-1ubuntu2.4
libcurl3-gnutls 7.55.1-1ubuntu2.4
libcurl3-nss 7.55.1-1ubuntu2.4

Ubuntu 16.04 LTS:
curl 7.47.0-1ubuntu2.7
libcurl3 7.47.0-1ubuntu2.7
libcurl3-gnutls 7.47.0-1ubuntu2.7
libcurl3-nss 7.47.0-1ubuntu2.7

Ubuntu 14.04 LTS:
curl 7.35.0-1ubuntu2.15
libcurl3 7.35.0-1ubuntu2.15
libcurl3-gnutls 7.35.0-1ubuntu2.15
libcurl3-nss 7.35.0-1ubuntu2.15

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3598-1
CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122

Package Information:
https://launchpad.net/ubuntu/+source/curl/7.55.1-1ubuntu2.4
https://launchpad.net/ubuntu/+source/curl/7.47.0-1ubuntu2.7
https://launchpad.net/ubuntu/+source/curl/7.35.0-1ubuntu2.15

—–BEGIN PGP SIGNATURE—–

iQIcBAEBCgAGBQJaqnlqAAoJEGVp2FWnRL6TCjUQALjx7nOytBdDSPGu97/bOouM
DuPApLK2D11qam68nrs+Y6OXoBykqMGcIqz1MBMn2cNPa/efhdx0wO//XjnmQ/WL
dN+2bj5DPzUAEHFV1Qd32sswh8vl+xh4s4Av7C/u26Kqayc8t9pq6OpO1PPu7bdg
oLo4WUVWM88b73GhqsZVW8xVubVUxdYJxpzQFDCFvf/E5R5MdeLNk5xFle8au4T6
N/TmFdheKlaqqlPwKbmM6qZEZnd6qkg5FpkvvAfCtu8AoQpfCteLOZCWYpEySDov
15iP5MpZThSAV71VgnXI65wQ/JJMUdaDcIe8O4JGng1uoTI+b3KiNCUPgeVkzIfX
Th55sf939sCLuRchBvGvz96SWBbE1GzmjyCBOFwgQIhZWZ73Mul0AqiDbnUFrthY
JhBz8RWWXhtAFdym92kCkDAZVka+I3FnvqRdEp3npwHthW95d12EF2zCmQ/edA49
5lKUrRQtzE6l+Cp7Gsj/yR6tCWdCKKhAmh9FOYuuVNAPxLoC3zxM5Lnbtdl5gmxD
+X/gbuuW2g/AGdP8byGh0R2TqOpragc24EEhFlwsmt40cK3X6K88xdEJmaWqO77Z
9g+v5n5qsH51uQ0WJ9MbmxIy8iIER08xWPWshPkR0Zcebw/H5pQblYVhVusBd1mJ
qDnPwpqcSeLmC5p5qf8D
=eHO5
—–END PGP SIGNATURE—–
—