[Git][security-tracker-team/security-tracker][master] 2 commits: Add fixed version for new curl CVEs

[Alessandro Ghedini]

Alessandro Ghedini pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7d6222ea by Alessandro Ghedini at 2019-02-06T20:55:28Z
Add fixed version for new curl CVEs

- - - - -
c298d18e by Alessandro Ghedini at 2019-02-06T20:55:28Z
Reserve curl DSA

- - - - -


3 changed files:

- data/CVE/list
- data/DSA/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -8345,13 +8345,13 @@ CVE-2019-3824
 	RESERVED
 CVE-2019-3823 [curl: SMTP end-of-response out-of-bounds read]
 	RESERVED
-	- curl <unfixed>
+	- curl 7.64.0-1
 	NOTE: https://curl.haxx.se/docs/CVE-2019-3823.html
 	NOTE: Fixed by: https://github.com/curl/curl/commit/39df4073e5413fcdbb5a38da0c1ce6f1c0ceb484
 	NOTE: Introduced by: https://github.com/curl/curl/commit/2766262a68688c1dd8143f9c4be84b46c408b70a
 CVE-2019-3822 [curl: NTLMv2 type-3 header stack buffer overflow]
 	RESERVED
-	- curl <unfixed>
+	- curl 7.64.0-1
 	NOTE: https://curl.haxx.se/docs/CVE-2019-3822.html
 	NOTE: Fixed by: https://github.com/curl/curl/commit/50c9484278c63b958655a717844f0721263939cc
 	NOTE: Introduced by: https://github.com/curl/curl/commit/86724581b6c02d160b52f817550cfdfc9c93af62
@@ -25982,7 +25982,7 @@ CVE-2018-16891
 	RESERVED
 CVE-2018-16890 [curl: NTLM type-2 out-of-bounds buffer read]
 	RESERVED
-	- curl <unfixed>
+	- curl 7.64.0-1
 	NOTE: https://curl.haxx.se/docs/CVE-2018-16890.html
 	NOTE: Fixed by: https://github.com/curl/curl/commit/b780b30d1377adb10bbe774835f49e9b237fb9bb
 	NOTE: Introduced by: https://github.com/curl/curl/commit/86724581b6c02d160b52f817550cfdfc9c93af62


=====================================
data/DSA/list
=====================================
@@ -1,3 +1,6 @@
+[06 Feb 2019] DSA-4386-1 curl - security update
+	{CVE-2018-16890 CVE-2019-3822 CVE-2019-3823}
+	[stretch] - curl 7.52.1-5+deb9u9
 [05 Feb 2019] DSA-4385-1 dovecot - security update
 	{CVE-2019-3814}
 	[stretch] - dovecot 1:2.2.27-3+deb9u3


=====================================
data/dsa-needed.txt
=====================================
@@ -20,8 +20,6 @@ ansible
 --
 chromium
 --
-curl (ghedo)
---
 faad2
   not yet fixed upstream
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/compare/5ab2063a8c495e35ed26a7ed897b1ce650a16db5...c298d18e5deae14f41ef87a2e7ea17490c47cec4

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/compare/5ab2063a8c495e35ed26a7ed897b1ce650a16db5...c298d18e5deae14f41ef87a2e7ea17490c47cec4
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20190206/f922a93c/attachment.html>