ALAS-2015-551


Amazon Linux AMI Security Advisory: ALAS-2015-551
Advisory Release Date: 2015-06-18 20:57 Pacific
Severity: Medium

Issue Overview:

As discussed upstream, libcurl can wrongly send HTTP credentials when re-using connections. (CVE-2015-3236 )

Also discussed upstream, libcurl can get tricked by a malicious SMB server to send off data it did not intend to. (CVE-2015-3237 )


Affected Packages:

curl


Issue Correction:
Run yum update curl to update your system.

New Packages:
i686:
    curl-7.40.0-3.51.amzn1.i686
    libcurl-7.40.0-3.51.amzn1.i686
    libcurl-devel-7.40.0-3.51.amzn1.i686
    curl-debuginfo-7.40.0-3.51.amzn1.i686

src:
    curl-7.40.0-3.51.amzn1.src

x86_64:
    curl-7.40.0-3.51.amzn1.x86_64
    libcurl-devel-7.40.0-3.51.amzn1.x86_64
    libcurl-7.40.0-3.51.amzn1.x86_64
    curl-debuginfo-7.40.0-3.51.amzn1.x86_64