Bugzilla – Bug 814655
VUL-0: CVE-2013-1944: curl: cookie domain tailmatch
Last modified: 2018-10-19 18:09:34 UTC
bugbot adjusting priority
CVE-2013-1944
Curl 7.30.0 is out. The issue is now public.
ok!
Vita, what packages are affected?
(In reply to comment #8) > Vita, > what packages are affected? Every single one. Affected versions: all versions to and including 7.29.0 Not affected versions: curl >= 7.30.0
This is an autogenerated message for OBS integration: This bug (814655) was mentioned in https://build.opensuse.org/request/show/163893 Factory / curl
Curl packages submitted. In case you wondered why I omitted test1216: There are two tests for this vulnerability in the upstream git, namely https://github.com/bagder/curl/blob/master/tests/data/test1216 and https://github.com/bagder/curl/blob/master/tests/data/test1218 I had to disable test 1216 because it fails due to different cookie sorting in older curl releases. We're missing this commit (and older distributions some more): https://github.com/bagder/curl/commit/762961fe352dbb8bc08f58b26ca8a18e7dd1999d
This is an autogenerated message for OBS integration: This bug (814655) was mentioned in https://build.opensuse.org/request/show/170864 Maintenance / https://build.opensuse.org/request/show/170865 Maintenance /
This is an autogenerated message for OBS integration: This bug (814655) was mentioned in https://build.opensuse.org/request/show/173085 Evergreen:11.2 / curl
openSUSE-SU-2013:0726-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 814655 CVE References: CVE-2013-1944 Sources used: openSUSE 12.2 (src): curl-7.25.0-2.4.1 openSUSE 12.1 (src): curl-7.22.0-2.6.1
released
Update released for: compat-curl2, compat-curl2-32bit, compat-curl2-64bit, compat-curl2-debuginfo, compat-curl2-x86 Products: SLE-DESKTOP 10-SP4 (i386, x86_64) SLE-SERVER 10-SP4 (i386, ia64, ppc, s390x, x86_64)
Update released for: curl, curl-debuginfo, curl-debugsource, libcurl-devel, libcurl4, libcurl4-32bit, libcurl4-x86 Products: SLE-DEBUGINFO 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLE-DESKTOP 11-SP2 (i386, x86_64) SLE-SDK 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLE-SERVER 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLES4VMWARE 11-SP2 (i386, x86_64)
Update released for: curl, curl-32bit, curl-64bit, curl-debuginfo, curl-devel, curl-x86 Products: SLE-DESKTOP 10-SP4 (i386, x86_64) SLE-SDK 10-SP4 (i386, ia64, ppc, s390x, x86_64) SLE-SERVER 10-SP4 (i386, ia64, ppc, s390x, x86_64)
This is an autogenerated message for OBS integration: This bug (814655) was mentioned in https://build.opensuse.org/request/show/175979 Evergreen:11.2 / curl
openSUSE-SU-2013:0876-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 814655 CVE References: CVE-2013-1944 Sources used: openSUSE 12.3 (src): curl-7.28.1-4.13.1
openSUSE-SU-2013:0879-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 814655 CVE References: CVE-2013-1944 Sources used: openSUSE 11.4 (src): curl-7.21.2-29.1
The SWAMPID for this issue is 52939. This issue was rated as moderate. Please submit fixed packages until 2013-06-27. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
Update released for: libcurl4, libcurl4-32bit, libcurl4-debuginfo Products: SLE-DESKTOP 10-SP4 (i386, x86_64)
The SWAMPID for this issue is 54707. This issue was rated as moderate. Please submit fixed packages until 2013-10-29. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
Update released for: curl, curl-debuginfo, curl-debugsource, libcurl-devel, libcurl4, libcurl4-32bit Products: SLE-DEBUGINFO 11-SP1 (i386, s390x, x86_64) SLE-SERVER 11-SP1-LTSS (i386, s390x, x86_64) SLES4VMWARE 11-SP1-LTSS (i386, x86_64)