CVE-2018-16839

Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

libcurl contains a buffer overrun in the SASL authentication code.

The internal function Curl_auth_create_plain_message fails to correctly verify that the passed in lengths for name and password are not too long, then calculates a buffer size to allocate.

On systems with a 32-bit size_t, the math to calculate the buffer size triggers an integer overflow when the username length exceeds 1GB and the password name length is close to 2GB in size. This integer overflow usually causes a tiny buffer to actually get allocated instead of the intended huge one, making the use of that buffer end up in a heap buffer overflow.

(This bug is similar to CVE-2018-14618.)

These are all security issues fixed in the curl-7.79.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for curl fixes the following issues:

• CVE-2018-16839: A SASL password overflow via integer overflow was fixed which could lead to crashes (bsc#1112758)
• CVE-2018-16840: A use-after-free in SASL handle close was fixed which could lead to crashes (bsc#1112758)
• CVE-2018-16842: A Out-of-bounds Read in tool_msgs.c was fixed which could lead to crashes (bsc#1113660)

This update for curl fixes the following issues:

Security issues fixed:

• CVE-2019-3822: Fixed a NTLMv2 type-3 header stack buffer overflow (bsc#1123377).
• CVE-2019-3823: Fixed an out-of-bounds read in the SMTP end-of-response (bsc#1123378).
• CVE-2018-16890: Fixed an out-of-bounds buffer read in NTLM type2 (bsc#1123371).
• CVE-2018-16842: Fixed an out-of-bounds read in tool_msgs.c (bsc#1113660).
• CVE-2018-16840: Fixed a use-after-free in handle close (bsc#1113029).
• CVE-2018-16839: Fixed an SASL password overflow caused by an integer overflow (bsc#1112758).

This update for curl fixes the following issues:

Security issue fixed:

• CVE-2018-16839: Fixed a buffer overflow in the SASL authentication code (bsc#1112758).

Harry Sintonen discovered that curl incorrectly handled SASL authentication. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-16839)

Brian Carpenter discovered that curl incorrectly handled memory when closing certain handles. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-16840)

Brian Carpenter discovered that the curl command-line tool incorrectly handled error messages. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2018-16842)