exploitDog

ALT-PU-2016-1536

Низкий

ALT-PU-2016-1536: package curl update to version 7.49.0-alt1

Источник

errata.altlinux.org

Дата публикации

24.05.2016

Дата обновления

24.05.2016

Устраненные уязвимости

1

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades curl to version 7.49.0-alt1.

Устраненные уязвимости1

Ссылки1

ALT-PU-2016-1536 https://errata.altlinux.org/ALT-PU-2016-1536

Связанные уязвимости

CVE-2016-3739

CVSS3: 5.3

ubuntu

больше 10 лет назад

The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.

CVE-2016-3739

redhat

больше 10 лет назад

The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.

CVE-2016-3739

CVSS3: 5.3

nvd

больше 10 лет назад

The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.

CVE-2016-3739

CVSS3: 5.3

debian

больше 10 лет назад

The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) pola ...

GHSA-4rcg-2r46-4hcc

CVSS3: 5.3

github

больше 4 лет назад

The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.