| Summary: | <net-misc/curl-7.65.0: multiple vulnerabilities (CVE-2019-{5435,5436}) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Thomas Deutschmann (RETIRED) <whissi> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | anthonyryan1, blueness |
| Priority: | Normal | Keywords: | STABLEREQ |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | A3 [glsa+ cve] | ||
| Package list: |
net-misc/curl-7.65.0
|
Runtime testing required: | --- |
|
Description
Thomas Deutschmann (RETIRED)
2019-05-15 18:46:36 UTC
(In reply to Thomas Deutschmann from comment #0) > Incoming details. curl-7.65.0 is on the tree. @arch teams please start KEYWORDS="alpha amd64 arm arm64 ia64 ppc ppc64 x8" @minor arch teams, i'm cc-ing you too since this is an important package with an important update. stable on amd64 stable on arm64 sparc stable ia64 stable ppc stable ppc64 stable hppa stable x86 stable s390 stable alpha stable Just a heads up, we're seeing production segfaults after this stabilization. Seems to be DNS related and already reported upstream: https://github.com/curl/curl/issues/3995 (In reply to Anthony Ryan from comment #12) > Just a heads up, we're seeing production segfaults after this stabilization. > > Seems to be DNS related and already reported upstream: > https://github.com/curl/curl/issues/3995 0.65.1 was released and the ebuild is in the tree, but it doesn't seem to address you issue :( Just in case, can you test 0.65.1 and open a separate bug if you verify that the seg fault is there too. Unfortunately we need to move forward for security reasons. When a patch becomes available, I'll back port it. arm stable Added to an existing GLSA request. This issue was resolved and addressed in GLSA 202003-29 at https://security.gentoo.org/glsa/202003-29 by GLSA coordinator Thomas Deutschmann (whissi). |
