CVE-2019-5481

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

libcurl can be told to use kerberos over FTP to a server, as set with the CURLOPT_KRBLEVEL option.

During such kerberos FTP data transfer, the server sends data to curl in blocks with the 32-bit size of each block first and then that amount of data immediately following.

A malicious or broken server can claim to send a large block and if by doing that it makes curl's subsequent call to realloc() to fail, curl would then misbehave in the exit path and double free the memory.

In practical terms, an up to 4 GB memory area may well be fine to allocate on a modern 64-bit system but on 32-bit systems it fails.

Kerberos FTP is a rarely used protocol with curl. Also, Kerberos authentication is usually only attempted and used with servers that the client has a previous association with.

The updated packages fix security vulnerabilities:

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. (CVE-2019-5435)

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1 (CVE-2019-5436).

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3 (CVE-2019-5481).

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3 (CVE-2019-5482).

This update for curl fixes the following issues:

Security issues fixed:

• CVE-2019-5481: Fixed FTP-KRB double-free during kerberos FTP data transfer (bsc#1149495).
• CVE-2019-5482: Fixed TFTP small blocksize heap buffer overflow (bsc#1149496).

This update was imported from the SUSE:SLE-15:Update update project.

This update for curl fixes the following issues:

Security issues fixed:

• CVE-2019-5481: Fixed FTP-KRB double-free during kerberos FTP data transfer (bsc#1149495).
• CVE-2019-5482: Fixed TFTP small blocksize heap buffer overflow (bsc#1149496).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the curl-7.79.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for curl fixes the following issues:

Security issues fixed:

• CVE-2019-5481: Fixed FTP-KRB double-free during kerberos FTP data transfer (bsc#1149495).
• CVE-2019-5482: Fixed TFTP small blocksize heap buffer overflow (bsc#1149496).

This update for curl fixes the following issues:

Security issues fixed:

• CVE-2019-5481: Fixed a double-free during kerberos FTP data transfer. (bsc#1149495)
• CVE-2019-5482: Fixed a TFTP small block size heap buffer overflow (bsc#1149496).

Thomas Vegas discovered that curl incorrectly handled memory when using Kerberos over FTP. A remote attacker could use this issue to crash curl, resulting in a denial of service. (CVE-2019-5481)

Thomas Vegas discovered that curl incorrectly handled memory during TFTP transfers. A remote attacker could use this issue to crash curl, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-5482)