Test ID:	1.3.6.1.4.1.25623.1.0.703638
Category:	Debian Local Security Checks
Title:	Debian Security Advisory DSA 3638-1 (curl - security update)
Summary:	Several vulnerabilities were discovered;in cURL, an URL transfer library:;;CVE-2016-5419;Bru Rom discovered that libcurl would attempt to resume a TLS session;even if the client certificate had changed.;;CVE-2016-5420;It was discovered that libcurl did not consider client certificates;when reusing TLS connections.;;CVE-2016-5421;Marcelo Echeverria and Fernando Munoz discovered that libcurl was;vulnerable to a use-after-free flaw.
Description:	Summary: Several vulnerabilities were discovered in cURL, an URL transfer library: CVE-2016-5419 Bru Rom discovered that libcurl would attempt to resume a TLS session even if the client certificate had changed. CVE-2016-5420 It was discovered that libcurl did not consider client certificates when reusing TLS connections. CVE-2016-5421 Marcelo Echeverria and Fernando Munoz discovered that libcurl was vulnerable to a use-after-free flaw. Affected Software/OS: curl on Debian Linux Solution: For the stable distribution (jessie), these problems have been fixed in version 7.38.0-4+deb8u4. For the unstable distribution (sid), these problems have been fixed in version 7.50.1-1. We recommend that you upgrade your curl packages. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-5419 BugTraq ID: 92292 http://www.securityfocus.com/bid/92292 BugTraq ID: 92319 http://www.securityfocus.com/bid/92319 Debian Security Information: DSA-3638 (Google Search) http://www.debian.org/security/2016/dsa-3638 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/ https://security.gentoo.org/glsa/201701-47 https://curl.haxx.se/docs/adv_20160803A.html RedHat Security Advisories: RHSA-2016:2575 http://rhn.redhat.com/errata/RHSA-2016-2575.html RedHat Security Advisories: RHSA-2016:2957 http://rhn.redhat.com/errata/RHSA-2016-2957.html RedHat Security Advisories: RHSA-2018:3558 https://access.redhat.com/errata/RHSA-2018:3558 http://www.securitytracker.com/id/1036538 http://www.securitytracker.com/id/1038341 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059 SuSE Security Announcement: openSUSE-SU-2016:2227 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html SuSE Security Announcement: openSUSE-SU-2016:2379 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html http://www.ubuntu.com/usn/USN-3048-1 Common Vulnerability Exposure (CVE) ID: CVE-2016-5420 BugTraq ID: 92309 http://www.securityfocus.com/bid/92309 https://curl.haxx.se/docs/adv_20160803B.html http://www.securitytracker.com/id/1036537 http://www.securitytracker.com/id/1036739 Common Vulnerability Exposure (CVE) ID: CVE-2016-5421 BugTraq ID: 92306 http://www.securityfocus.com/bid/92306 https://curl.haxx.se/docs/adv_20160803C.html http://www.securitytracker.com/id/1036536
Copyright	Copyright (C) 2016 Greenbone Networks GmbH http://greenbone.net

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.