Debian Security Advisory

DLA-1121-1 curl -- LTS security update

Date Reported:
05 Oct 2017
Affected Packages:
Security database references:
In Mitre's CVE dictionary: CVE-2017-1000254.
More information:

It was discovered that there was a out-of-bounds read vulnerability in curl, a command-line and library for transferring data over HTTP/FTP, etc. A malicious FTP server could abuse this to prevent curl-based clients from interacting with it.

See for more details.

For Debian 7 Wheezy, this issue has been fixed in curl version 7.26.0-1+wheezy21.

We recommend that you upgrade your curl packages.