You are here
Home > Preporuke > Ranjivosti programskog paketa curl

Ranjivosti programskog paketa curl

  • Detalji os-a: LMV
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LMV

Hash: SHA1


Mandriva Linux Security Advisory MDVSA-2014:187

Package : curl
Date : September 25, 2014
Affected: Business Server 1.0

Problem Description:

Updated curl packages fix security vulnerabilities:

In cURL before 7.38.0, libcurl can be fooled to both sending cookies
to wrong sites and into allowing arbitrary sites to set cookies for
others. For this problem to trigger, the client application must use
the numerical IP address in the URL to access the site (CVE-2014-3613).

In cURL before 7.38.0, libcurl wrongly allows cookies to be set for Top
Level Domains (TLDs), thus making them apply broader than cookies are
allowed. This can allow arbitrary sites to set cookies that then would
get sent to a different and unrelated site or domain (CVE-2014-3620).


Updated Packages:

Mandriva Business Server 1/X86_64:
536d4cd31d069a4fef2af0782b82f5aa mbs1/x86_64/curl-7.24.0-3.6.mbs1.x86_64.rpm
c637bcc4b71898f92995a1470a5f5768 mbs1/x86_64/curl-examples-7.24.0-3.6.mbs1.x86_64.rpm
c2a1ef105b155e503249526ccd3bb856 mbs1/x86_64/lib64curl4-7.24.0-3.6.mbs1.x86_64.rpm
bebb361f004e16d892fe8fec8660a932 mbs1/x86_64/lib64curl-devel-7.24.0-3.6.mbs1.x86_64.rpm
f7f91a987cdbdba0fddc396cf650c2a6 mbs1/SRPMS/curl-7.24.0-3.6.mbs1.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver 0x22458A98

You can view other update advisories for Mandriva Linux at:

If you want to report vulnerabilities, please contact


Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
Version: GnuPG v1.4.12 (GNU/Linux)


To unsubscribe, send a email to
with this subject : unsubscribe security-announce
Want to buy your Pack or Services from Mandriva?
Go to

AutorTomislav Protega
Cert idNCERT-REF-2014-09-0003-ADV
CveCVE-2014-3613 CVE-2014-3620
ID izvornikaMDVSA-2014:187
More in Preporuke
Sigurnosni nedostatak programskog paketa phpMyAdmin

Otkriven je sigurnosni nedostatak u programskom paketu phpMyAdmin za operacijski sustav Fedora. Otkriveni nedostatak potencijalnim napadačima omogućuje izvršavanje proizvoljnog programskog...