Medium: curl

Issue Overview:

As discussed upstream (http://curl.haxx.se/docs/adv_20150617A.html), libcurl can wrongly send HTTP credentials when re-using connections. (CVE-2015-3236)

Also discussed upstream (http://curl.haxx.se/docs/adv_20150617B.html), libcurl can get tricked by a malicious SMB server to send off data it did not intend to. (CVE-2015-3237)

Affected Packages:

curl

Issue Correction:
Run yum update curl to update your system.

New Packages:

i686:  
    curl-7.40.0-3.51.amzn1.i686  
    libcurl-7.40.0-3.51.amzn1.i686  
    libcurl-devel-7.40.0-3.51.amzn1.i686  
    curl-debuginfo-7.40.0-3.51.amzn1.i686  
  
src:  
    curl-7.40.0-3.51.amzn1.src  
  
x86_64:  
    curl-7.40.0-3.51.amzn1.x86_64  
    libcurl-devel-7.40.0-3.51.amzn1.x86_64  
    libcurl-7.40.0-3.51.amzn1.x86_64  
    curl-debuginfo-7.40.0-3.51.amzn1.x86_64  

Additional References

Red Hat: CVE-2015-3236, CVE-2015-3237

Mitre: CVE-2015-3236, CVE-2015-3237