[SECURITY] [DLA 1143-1] curl security update

Package : curl Version : 7.26.0-1+wheezy22 CVE ID : CVE-2017-1000257 Brian Carpenter, Geeknik Labs, 0xd34db347, and independently reported by the OSS-Fuzz project, detected a out of bounds read during IMAP FETCH response. For Debian 7 "Wheezy", this problem has been fixed in version...

[slackware-security] curl

New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/curl-7.56.1-i586-1slack14.2.txz: Upgraded. This update fixes a security issue: IMAP FETCH response out of bounds read may...

SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2017:2831-1)

This update for curl fixes the following issues: Security issues fixed : - CVE-2017-1000254: FTP PWD response parser out of bounds read bsc1061876 - CVE-2017-1000257: IMAP FETCH response out of bounds read bsc1063824 Bugs fixed : - Fixed error 'error:1408F10B:SSL routines' when connecting to ftps...

Ubuntu 14.04 LTS / 16.04 LTS : curl vulnerability (USN-3457-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3457-1 advisory. Brian Carpenter discovered that curl incorrectly handled IMAP FETCH response lines. A remote attacker could use this issue to cause curl to crash,...

FreeBSD : cURL -- out of bounds read (143ec3d6-b7cf-11e7-ac58-b499baebfeaf)

The cURL project reports : libcurl contains a buffer overrun flaw in the IMAP handler. An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that non-existing data with a pointer and the size...

USN-3457-1: curl vulnerability

Brian Carpenter discovered that curl incorrectly handled IMAP FETCH response lines. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code...

CURL-CVE-2017-1000257 IMAP FETCH response out of bounds read

libcurl contains a buffer overrun flaw in the IMAP handler. An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that non-existing data with a pointer and the size zero to the deliver-data...

CVE-2017-1000257

A buffer overrun flaw was found in the IMAP handler of libcurl. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the application. Mitigation Switch off IMAP in CURLOPTPROTOCOLS...

CVE-2017-1000257

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that non-existing data with a pointer and the size zero to the deliver-data function. libcurl's deliver-data function treats zero as a mag...

Security fix for the ALT Linux 8 package curl version 7.56.1-alt1

Oct. 23, 2017 Anton Farygin 7.56.1-alt1 - new version - fixes: CVE-2017-1000257 libcurl contains a buffer overrun flaw in the IMAP handler...

cURL -- out of bounds read

The cURL project reports: libcurl contains a buffer overrun flaw in the IMAP handler. An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that non-existing data with a pointer and the size...

Internet Bug Bounty: Out of bounds read in libcurl's IMAP FETCH response parser

Reported to the curl security mailing list on 6 October 2017. Acknowledged on 6 October 2017. Patched on 8 October 2017. Reported to distros@openwall on 17 October 2017. Public release on 23 October 2017. CVE Pending. Vulnerability An IMAP FETCH response line indicates the size of the returned...

Security update for MozillaThunderbird (important)

Mozilla Thunderbird was updated to 52.4.0 boo1060445 new behavior was introduced for replies to mailing list posts: "When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header". A new preference mail.overridelistreplyto allows to restore the previous...

Security update for MozillaThunderbird (important)

Mozilla Thunderbird was updated to 52.4.0 boo1060445 new behavior was introduced for replies to mailing list posts: "When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header". A new preference mail.overridelistreplyto allows to restore the previous...

openSUSE Security Update : MozillaThunderbird (openSUSE-2017-1144)

Mozilla Thunderbird was updated to 52.4.0 boo1060445 - new behavior was introduced for replies to mailing list posts: 'When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header'. A new preference mail.overridelistreplyto allows to restore the previous...

OPENSUSE-SU-2017:2710-1 Security update for MozillaThunderbird

Mozilla Thunderbird was updated to 52.4.0 boo1060445 new behavior was introduced for replies to mailing list posts: 'When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header'. A new preference mail.overridelistreplyto allows to restore the previous...

OPENSUSE-SU-2017:2707-1 Security update for MozillaThunderbird

Mozilla Thunderbird was updated to 52.4.0 boo1060445 new behavior was introduced for replies to mailing list posts: 'When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header'. A new preference mail.overridelistreplyto allows to restore the previous...

Description of the security update for Outlook 2016: October 10, 2017

None None...

[SECURITY] Fedora 27 Update: cyrus-imapd-3.0.4-1.fc27

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contac ts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use fro...

SquirrelMail: Remote Code Execution

Background SquirrelMail is a webmail package written in PHP. It supports IMAP and SMTP and can optionally be installed with SQL support. Description It was discovered that the sendmail.cf file is mishandled in a popen call. Impact A remote attacker, by enticing a user to open an e-mail attachment...