Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4511

Re: [SECURITY] [DSA 3455-1] curl security update

Show all headers | View raw

Hi,

I notice that there are no fixes for oldstable. Is oldstable not
affected by this security issue?

All the best,
Wolfgang

Am Mittwoch, den 27.01.2016, 12:16 +0000 schrieb Alessandro Ghedini:
> -------------------------------------------------------------------------
> Debian Security Advisory DSA-3455-1                   security@debian.org
> https://www.debian.org/security/                       Alessandro Ghedini
> January 27, 2016                      https://www.debian.org/security/faq
> -------------------------------------------------------------------------
> 
> Package        : curl
> CVE ID         : CVE-2016-0755
> 
> Isaac Boukris discovered that cURL, an URL transfer library, reused
> NTLM-authenticated proxy connections without properly making sure that
> the connection was authenticated with the same credentials as set for
> the new transfer. This could lead to HTTP requests being sent over the
> connection authenticated as a different user.
> 
> For the stable distribution (jessie), this problem has been fixed in
> version 7.38.0-4+deb8u3.
> 
> For the unstable distribution (sid), this problem has been fixed in
> version 7.47.0-1.
> 
> We recommend that you upgrade your curl packages.
> 
> Further information about Debian Security Advisories, how to apply
> these updates to your system and frequently asked questions can be
> found at: https://www.debian.org/security/
> 
> Mailing list: debian-security-announce@lists.debian.org

Back to linux.debian.security | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: [SECURITY] [DSA 3455-1] curl security update Wolfgang Jeltsch <7o2lccqg@acme.softbase.org> - 2016-02-02 10:50 +0100
  Re: [SECURITY] [DSA 3455-1] curl security update Freddy Spierenburg <freddy@snarl.nl> - 2016-02-02 11:10 +0100
    Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl  security update) Wolfgang Jeltsch <7o2lccqg@acme.softbase.org> - 2016-02-02 16:40 +0100
      Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1]  curl security update) Yves-Alexis Perez <corsac@debian.org> - 2016-02-02 17:20 +0100
        Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1]  curl security update) Wolfgang Jeltsch <7o2lccqg@acme.softbase.org> - 2016-02-02 17:30 +0100
          Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update) Holger Levsen <holger@layer-acht.org> - 2016-02-02 18:20 +0100
          Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1]  curl security update) Sébastien NOBILI <sebnewsletter@free.fr> - 2016-02-02 18:50 +0100
          Re: Security support incomplete? Davide Prina <davide.prina@gmail.com> - 2016-02-02 22:30 +0100
            Re: Security support incomplete? Davide Prina <davide.prina@gmail.com> - 2016-02-02 23:10 +0100
        Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1]  curl security update) Marc Haber <mh+debian-security@zugschlus.de> - 2016-02-02 18:00 +0100
        Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1]  curl security update) Lupe Christoph <lupe@lupe-christoph.de> - 2016-02-02 18:10 +0100
        Re: Security support incomplete? "Pedro M. Jorge" <pmjorge@lip.pt> - 2016-02-02 18:50 +0100
          Re: Security support incomplete? Yves-Alexis Perez <corsac@debian.org> - 2016-02-02 19:10 +0100

csiph-web