curl: CVE-2017-1000254: FTP PWD response parser out of bounds read

Related Vulnerabilities: CVE-2017-1000254  

Debian Bug report logs - #877671
curl: CVE-2017-1000254: FTP PWD response parser out of bounds read

version graph

Reported by: Salvatore Bonaccorso <carnil@debian.org>

Date: Wed, 4 Oct 2017 06:21:02 UTC

Severity: serious

Tags: fixed-upstream, patch, security, upstream

Found in version curl/7.38.0-4

Fixed in versions curl/7.38.0-4+deb8u6, curl/7.52.1-5+deb9u1, 7.56.1-1

Done: László Böszörményi (GCS) <gcs@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Alessandro Ghedini <ghedo@debian.org>:
Bug#877671; Package src:curl. (Wed, 04 Oct 2017 06:21:04 GMT) (full text, mbox, link).


Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Alessandro Ghedini <ghedo@debian.org>. (Wed, 04 Oct 2017 06:21:04 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: curl: CVE-2017-1000254: FTP PWD response parser out of bounds read
Date: Wed, 04 Oct 2017 08:17:06 +0200
Source: curl
Version: 7.38.0-4
Severity: important
Tags: security patch upstream fixed-upstream

Hi,

the following vulnerability was published for curl, filling for
reference, Alessandro is aware.

CVE-2017-1000254[0]:
FTP PWD response parser out of bounds read

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-1000254
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000254
[1] https://curl.haxx.se/docs/adv_20171004.html

Regards,
Salvatore



Marked as fixed in versions curl/7.52.1-5+deb9u1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Wed, 04 Oct 2017 21:33:03 GMT) (full text, mbox, link).


Marked as fixed in versions curl/7.38.0-4+deb8u6. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Wed, 04 Oct 2017 21:33:04 GMT) (full text, mbox, link).


Severity set to 'serious' from 'important' Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sun, 08 Oct 2017 07:21:06 GMT) (full text, mbox, link).


Reply sent to László Böszörményi (GCS) <gcs@debian.org>:
You have taken responsibility. (Wed, 25 Oct 2017 21:57:11 GMT) (full text, mbox, link).


Notification sent to Salvatore Bonaccorso <carnil@debian.org>:
Bug acknowledged by developer. (Wed, 25 Oct 2017 21:57:11 GMT) (full text, mbox, link).


Message #16 received at 877671-done@bugs.debian.org (full text, mbox, reply):

From: László Böszörményi (GCS) <gcs@debian.org>
To: 877671-done@bugs.debian.org
Subject: curl/CVE-2017-1000254 fixed in unstable
Date: Wed, 25 Oct 2017 23:45:39 +0200
Version: 7.56.1-1



Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Wed, 03 Jan 2018 07:29:14 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 16:33:15 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.