Security update for curl
curl was updated to fix five security issues. The following vulnerabilities were fixed: * CVE-2015-3143: curl could re-use NTML authenticateds connections * CVE-2015-3144: curl could access memory out of bounds with zero length host names * CVE-2015-3145: curl cookie parser could access memory out of boundary * CVE-2015-3148: curl could treat Negotiate as not connection-oriented * CVE-2015-3153: curl could have sent sensitive HTTP headers also to proxies
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
curl was updated to fix five security issues. The following vulnerabilities were fixed: * CVE-2015-3143: curl could re-use NTML authenticateds connections * CVE-2015-3144: curl could access memory out of bounds with zero length host names * CVE-2015-3145: curl cookie parser could access memory out of boundary * CVE-2015-3148: curl could treat Negotiate as not connection-oriented * CVE-2015-3153: curl could have sent sensitive HTTP headers also to proxies
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/927556
- https://bugzilla.suse.com/927607
- https://bugzilla.suse.com/927608
- https://bugzilla.suse.com/927746
- https://bugzilla.suse.com/928533
- https://www.suse.com/security/cve/CVE-2015-3143
- https://www.suse.com/security/cve/CVE-2015-3144
- https://www.suse.com/security/cve/CVE-2015-3145
- https://www.suse.com/security/cve/CVE-2015-3148
- https://www.suse.com/security/cve/CVE-2015-3153
- https://www.suse.com/support/update/announcement/2015/suse-su-20150990-1/