Debian Security Advisory

DLA-1379-1 curl -- LTS security update

Date Reported:

16 May 2018

Affected Packages:

curl

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2018-1000301.

More information:

It was discovered that there was an issue in the curl a command-line tool for downloading (eg.) data over HTTP.

curl could have be tricked into reading data beyond the end of a heap based buffer used to store downloaded content.

For more information, please see upstream's advisory at:

For Debian 7 Wheezy, this issue has been fixed in curl version 7.26.0-1+wheezy25+deb7u1.

We recommend that you upgrade your curl packages.