Security update for curl

Announcement ID:	SUSE-SU-2016:2699-1
Rating:	important
References:	bsc#1005633 bsc#1005634 bsc#1005635 bsc#1005637 bsc#1005638 bsc#1005640 bsc#1005642 bsc#1005643 bsc#1005645 bsc#1005646 bsc#998760
Cross-References:	CVE-2016-7167 CVE-2016-8615 CVE-2016-8616 CVE-2016-8617 CVE-2016-8618 CVE-2016-8619 CVE-2016-8620 CVE-2016-8621 CVE-2016-8622 CVE-2016-8623 CVE-2016-8624
CVSS scores:	CVE-2016-7167 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-8615 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2016-8616 ( NVD ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2016-8617 ( NVD ): 7.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2016-8618 ( SUSE ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVE-2016-8618 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-8619 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-8620 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-8621 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2016-8621 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2016-8622 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-8623 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2016-8624 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products:	SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP1

An update that solves 11 vulnerabilities can now be installed.

Description:

This update for curl fixes the following security issues:

• CVE-2016-8624: invalid URL parsing with '#' (bsc#1005646)
• CVE-2016-8623: Use-after-free via shared cookies (bsc#1005645)
• CVE-2016-8622: URL unescape heap overflow via integer truncation (bsc#1005643)
• CVE-2016-8621: curl_getdate read out of bounds (bsc#1005642)
• CVE-2016-8620: glob parser write/read out of bounds (bsc#1005640)
• CVE-2016-8619: double-free in krb5 code (bsc#1005638)
• CVE-2016-8618: double-free in curl_maprintf (bsc#1005637)
• CVE-2016-8617: OOB write via unchecked multiplication (bsc#1005635)
• CVE-2016-8616: case insensitive password comparison (bsc#1005634)
• CVE-2016-8615: cookie injection for other servers (bsc#1005633)
• CVE-2016-7167: escape and unescape integer overflows (bsc#998760)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Desktop 12 SP1
  zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-1591=1
• SUSE Linux Enterprise Software Development Kit 12 SP1
  zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-1591=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1
  zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-1591=1
• SUSE Linux Enterprise Server 12 SP1
  zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-1591=1

Package List:

• SUSE Linux Enterprise Desktop 12 SP1 (x86_64)
  • libcurl4-debuginfo-7.37.0-31.1
  • curl-debugsource-7.37.0-31.1
  • curl-debuginfo-7.37.0-31.1
  • curl-7.37.0-31.1
  • libcurl4-debuginfo-32bit-7.37.0-31.1
  • libcurl4-7.37.0-31.1
  • libcurl4-32bit-7.37.0-31.1
• SUSE Linux Enterprise Software Development Kit 12 SP1 (ppc64le s390x x86_64)
  • curl-debugsource-7.37.0-31.1
  • libcurl-devel-7.37.0-31.1
  • curl-debuginfo-7.37.0-31.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1 (ppc64le x86_64)
  • libcurl4-debuginfo-7.37.0-31.1
  • curl-debugsource-7.37.0-31.1
  • curl-debuginfo-7.37.0-31.1
  • curl-7.37.0-31.1
  • libcurl4-7.37.0-31.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1 (x86_64)
  • libcurl4-debuginfo-32bit-7.37.0-31.1
  • libcurl4-32bit-7.37.0-31.1
• SUSE Linux Enterprise Server 12 SP1 (ppc64le s390x x86_64)
  • libcurl4-debuginfo-7.37.0-31.1
  • curl-debugsource-7.37.0-31.1
  • curl-debuginfo-7.37.0-31.1
  • curl-7.37.0-31.1
  • libcurl4-7.37.0-31.1
• SUSE Linux Enterprise Server 12 SP1 (s390x x86_64)
  • libcurl4-debuginfo-32bit-7.37.0-31.1
  • libcurl4-32bit-7.37.0-31.1

References:

• https://www.suse.com/security/cve/CVE-2016-7167.html
• https://www.suse.com/security/cve/CVE-2016-8615.html
• https://www.suse.com/security/cve/CVE-2016-8616.html
• https://www.suse.com/security/cve/CVE-2016-8617.html
• https://www.suse.com/security/cve/CVE-2016-8618.html
• https://www.suse.com/security/cve/CVE-2016-8619.html
• https://www.suse.com/security/cve/CVE-2016-8620.html
• https://www.suse.com/security/cve/CVE-2016-8621.html
• https://www.suse.com/security/cve/CVE-2016-8622.html
• https://www.suse.com/security/cve/CVE-2016-8623.html
• https://www.suse.com/security/cve/CVE-2016-8624.html
• https://bugzilla.suse.com/show_bug.cgi?id=1005633
• https://bugzilla.suse.com/show_bug.cgi?id=1005634
• https://bugzilla.suse.com/show_bug.cgi?id=1005635
• https://bugzilla.suse.com/show_bug.cgi?id=1005637
• https://bugzilla.suse.com/show_bug.cgi?id=1005638
• https://bugzilla.suse.com/show_bug.cgi?id=1005640
• https://bugzilla.suse.com/show_bug.cgi?id=1005642
• https://bugzilla.suse.com/show_bug.cgi?id=1005643
• https://bugzilla.suse.com/show_bug.cgi?id=1005645
• https://bugzilla.suse.com/show_bug.cgi?id=1005646
• https://bugzilla.suse.com/show_bug.cgi?id=998760