USN-1346-1: curl vulnerability

Releases

• Ubuntu 11.10
• Ubuntu 11.04
• Ubuntu 10.10

Packages

• curl - HTTP, HTTPS, and FTP client and client libraries

Details

Dan Fandrich discovered that curl incorrectly handled URLs containing
embedded or percent-encoded control characters. If a user or automated
system were tricked into processing a specially crafted URL, arbitrary
data could be injected.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 11.10

• libcurl3-nss - 7.21.6-3ubuntu3.2
• libcurl3-gnutls - 7.21.6-3ubuntu3.2
• libcurl3 - 7.21.6-3ubuntu3.2

Ubuntu 11.04

• libcurl3-nss - 7.21.3-1ubuntu1.5
• libcurl3-gnutls - 7.21.3-1ubuntu1.5
• libcurl3 - 7.21.3-1ubuntu1.5

Ubuntu 10.10

• libcurl3-gnutls - 7.21.0-1ubuntu1.3
• libcurl3 - 7.21.0-1ubuntu1.3

In general, a standard system update will make all the necessary changes.

References

• CVE-2012-0036