[ASA-201811-4] curl: multiple issues

🗓️ 06 Nov 2018 00:00:00Reported by ArchLinuxType

archlinux

archlinux🔗 security.archlinux.org👁 71 Views

The curl package before 7.62.0-1 allows arbitrary code execution and information disclosur

Reporter	Title	Published	Views	Family All 181
IBM Security Bulletins	Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in cURL (CVE-2018-14618 CVE-2018-16840 CVE-2018-16842)	7 Dec 202322:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Dynamic System Analysis (DSA) Preboot is affected by vulnerabilities in cURL (CVE-2018-16840 CVE-2018-16842)	7 Dec 202322:45	–	ibm
IBM Security Bulletins	Security Bulletin: The Community Edition of IBM ILOG CPLEX Optimization Studio is affected by a vulnerability in libcurl (CVE-2018-16840)	19 Nov 201815:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Advanced Cloud Pak is vulnerable to a buffer overflow in the curl command (CVE-2018-16842)	7 May 201917:15	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in Red Hat® Enterprise Linux (RHEL) Server shipped with PurePower Integrated Manager (PPIM)	20 Dec 201908:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affecting IBM Watson Studio in Cloud Pak for Data are addressed	3 Mar 202514:36	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private - fluentd	12 Feb 201918:05	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Curl used in OS image for RedHat Enterprise Linux for Cloud Pak System (CVE-2018-16842)	6 May 202012:02	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in libCurl affects IBM Watson Studio Local	20 Dec 201913:58	–	ibm
IBM Security Bulletins	Security Bulletin: Vyatta 5600 vRouter Software Patches - Release 1801-s, 1801-t and 1801-u	5 Dec 201822:20	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Arch Linux	–	any	curl	7.62.0-1	curl-7.62.0-1-any.pkg.tar.zst

Source	Link
security	www.security.archlinux.org/AVG-795
curl	www.curl.haxx.se/docs/CVE-2018-16840.html
github	www.github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f
curl	www.curl.haxx.se/docs/CVE-2018-16842.html
github	www.github.com/curl/curl/commit/d530e92f59ae9bb2d47066c3c460b25d2ffeb211
security	www.security.archlinux.org/CVE-2018-16840
security	www.security.archlinux.org/CVE-2018-16842

06 Nov 2018 00:00Current

0.5Low risk

Vulners AI Score0.5

CVSS 27.5

CVSS 3.19.8

CVSS 34.4 - 9.1

EPSS0.03333

SSVC

curl arbitrary code execution information disclosure buffer over-read denial of service