ALAS-2016-766


Amazon Linux 1 Security Advisory: ALAS-2016-766
Advisory Release Date: 2016-11-10 18:00 Pacific
Advisory Updated Date: 2016-11-10 18:00 Pacific
Severity: Medium

Issue Overview:

This build resolves the following issues:

CVE-2016-8615: Cookie injection for other servers
CVE-2016-8616: Case insensitive password comparison
CVE-2016-8617: Out-of-bounds write via unchecked multiplication
CVE-2016-8618: Double-free in curl_maprintf
CVE-2016-8619: Double-free in krb5 code
CVE-2016-8620: Glob parser write/read out of bounds
CVE-2016-8621: curl_getdate out-of-bounds read
CVE-2016-8622: URL unescape heap overflow via integer truncation
CVE-2016-8623: Use-after-free via shared cookies
CVE-2016-8624: Invalid URL parsing with '#'


Affected Packages:

curl


Issue Correction:
Run yum update curl to update your system.

New Packages:
i686:
    libcurl-7.47.1-9.66.amzn1.i686
    libcurl-devel-7.47.1-9.66.amzn1.i686
    curl-7.47.1-9.66.amzn1.i686
    curl-debuginfo-7.47.1-9.66.amzn1.i686

src:
    curl-7.47.1-9.66.amzn1.src

x86_64:
    curl-7.47.1-9.66.amzn1.x86_64
    libcurl-devel-7.47.1-9.66.amzn1.x86_64
    libcurl-7.47.1-9.66.amzn1.x86_64
    curl-debuginfo-7.47.1-9.66.amzn1.x86_64