Debian — Security Information — DSA-4331-1 curl
Two vulnerabilities were discovered in cURL, an URL transfer library.
Harry Sintonen discovered that, on systems with a 32 bit size_t, an
integer overflow would be triggered when a SASL user name longer
than 2GB is used. This would in turn cause a very small buffer to be
allocated instead of the intended very huge one, which would trigger
a heap buffer overflow when the buffer is used.
Brian Carpenter discovered that the logic in the curl tool to wrap
error messages at 80 columns is flawed, leading to a read buffer
overflow if a single word in the message is itself longer than 80
For the stable distribution (stretch), these problems have been fixed in
We recommend that you upgrade your curl packages.
For the detailed security status of curl please refer to
its security tracker page at: