oss-sec mailing list archives
Re: CVE Request -- cURL/libCURL 7.20.0
From: Jan Lieskovsky <jlieskov () redhat com>
Date: Tue, 09 Mar 2010 15:18:34 +0100
Hi Steve, Jan Lieskovsky wrote:
Hi Steve, vendors, cURL upstream has released latest v7.20.0 version of cURL/libCURL fixing the "libcurl data callback excessive length" issue. References: [1] http://curl.haxx.se/docs/security.html#20100209 [2] http://curl.haxx.se/docs/adv_20100209.html [3] http://curl.haxx.se/libcurl-contentencoding.patch [4] http://curl.haxx.se/download.html Mitigation factors (from [1]): "This error is only present in zlib-enabled builds of libcurl and only ifautomatic decompression has been explicitly enabled by the application - itis disabled by default." Could you allocate CVE id for this?
Any update with assigning CVE id for this? Thanks, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Thanks && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Current thread:
- CVE Request -- cURL/libCURL 7.20.0 Jan Lieskovsky (Feb 09)
- Re: CVE Request -- cURL/libCURL 7.20.0 Jan Lieskovsky (Mar 09)
- <Possible follow-ups>
- Re: CVE Request -- cURL/libCURL 7.20.0 Vincent Danen (Mar 16)