Security update for curl

Announcement ID:	SUSE-SU-2018:1323-1
Rating:	moderate
References:	bsc#1081056 bsc#1083463 bsc#1084137 bsc#1084521 bsc#1084524 bsc#1084532 bsc#1085124 bsc#1086825 bsc#1087922 bsc#1090194
Cross-References:	CVE-2018-1000120 CVE-2018-1000121 CVE-2018-1000122
CVSS scores:	CVE-2018-1000120 ( SUSE ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVE-2018-1000120 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-1000121 ( SUSE ): 4.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2018-1000121 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-1000122 ( SUSE ): 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2018-1000122 ( NVD ): 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected Products:	Security Module for SUSE Linux Enterprise 11 11-SP3 SLES for SAP Applications 11-SP4 SUSE Linux Enterprise Point of Service 11 SP3 SUSE Linux Enterprise Server 11 SP3 LTSS 11-SP3 SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4

An update that solves three vulnerabilities and has seven security fixes can now be installed.

Description:

This update for curl fixes the following issues:

curl was updated to version 7.37.0 (fate#325339 bsc#1084137)

This update syncs the curl version to the one in SUSE Linux Enterprise 12 and is full binary compatible to the previous version.

This update is done to allow other third party software like "R" to be able to be used on the SUSE Linux Enterprise 11 codebase.

Following security issues were fixed:

• CVE-2018-1000120: A buffer overflow exists in the FTP URL handling that allowed an attacker to cause a denial of service or possible code execution (bsc#1084521).
• CVE-2018-1000121: A NULL pointer dereference exists in the LDAP code that allowed an attacker to cause a denial of service (bsc#1084524).
• CVE-2018-1000122: A buffer over-read exists in the RTSP+RTP handling code that allowed an attacker to cause a denial of service or information leakage (bsc#1084532).

The package also requires a libopenssl that implements the DEFAULT_SUSE cipher list (bsc#1081056, bsc#1083463,bsc#1086825)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Point of Service 11 SP3
  zypper in -t patch sleposp3-curl-13609=1
• SUSE Linux Enterprise Software Development Kit 11 SP4
  zypper in -t patch sdksp4-curl-13609=1
• Security Module for SUSE Linux Enterprise 11 11-SP3
  zypper in -t patch secsp3-curl-13609=1
• SUSE Linux Enterprise Server 11 SP3 LTSS 11-SP3
  zypper in -t patch slessp3-curl-13609=1
• SUSE Linux Enterprise Server 11 SP4
  zypper in -t patch slessp4-curl-13609=1
• SLES for SAP Applications 11-SP4
  zypper in -t patch slessp4-curl-13609=1

Package List:

• SUSE Linux Enterprise Point of Service 11 SP3 (i586)
  • libcurl4-7.37.0-70.27.1
  • curl-7.37.0-70.27.1
• SUSE Linux Enterprise Software Development Kit 11 SP4 (s390x x86_64 i586 ppc64 ia64)
  • libcurl-devel-7.37.0-70.27.1
• Security Module for SUSE Linux Enterprise 11 11-SP3 (s390x x86_64 i586 ppc64 ia64)
  • curl-openssl1-7.37.0-70.27.1
  • libcurl4-openssl1-7.37.0-70.27.1
• Security Module for SUSE Linux Enterprise 11 11-SP3 (ia64)
  • libcurl4-openssl1-x86-7.37.0-70.27.1
• Security Module for SUSE Linux Enterprise 11 11-SP3 (ppc64 s390x x86_64)
  • libcurl4-openssl1-32bit-7.37.0-70.27.1
• SUSE Linux Enterprise Server 11 SP3 LTSS 11-SP3 (s390x x86_64 i586)
  • libcurl4-7.37.0-70.27.1
  • curl-7.37.0-70.27.1
• SUSE Linux Enterprise Server 11 SP3 LTSS 11-SP3 (s390x x86_64)
  • libcurl4-32bit-7.37.0-70.27.1
• SUSE Linux Enterprise Server 11 SP4 (s390x x86_64 i586 ppc64 ia64)
  • libcurl4-7.37.0-70.27.1
  • curl-7.37.0-70.27.1
• SUSE Linux Enterprise Server 11 SP4 (ia64)
  • libcurl4-x86-7.37.0-70.27.1
• SUSE Linux Enterprise Server 11 SP4 (ppc64 s390x x86_64)
  • libcurl4-32bit-7.37.0-70.27.1
• SLES for SAP Applications 11-SP4 (ppc64 x86_64)
  • libcurl4-32bit-7.37.0-70.27.1
  • libcurl4-7.37.0-70.27.1
  • curl-7.37.0-70.27.1

References:

• https://www.suse.com/security/cve/CVE-2018-1000120.html
• https://www.suse.com/security/cve/CVE-2018-1000121.html
• https://www.suse.com/security/cve/CVE-2018-1000122.html
• https://bugzilla.suse.com/show_bug.cgi?id=1081056
• https://bugzilla.suse.com/show_bug.cgi?id=1083463
• https://bugzilla.suse.com/show_bug.cgi?id=1084137
• https://bugzilla.suse.com/show_bug.cgi?id=1084521
• https://bugzilla.suse.com/show_bug.cgi?id=1084524
• https://bugzilla.suse.com/show_bug.cgi?id=1084532
• https://bugzilla.suse.com/show_bug.cgi?id=1085124
• https://bugzilla.suse.com/show_bug.cgi?id=1086825
• https://bugzilla.suse.com/show_bug.cgi?id=1087922
• https://bugzilla.suse.com/show_bug.cgi?id=1090194