USN-1801-1: curl vulnerability
16 April 2013
Applications using libcurl could be made to expose sensitive information over the network.
- curl - HTTP, HTTPS, and FTP client and client libraries
YAMADA Yasuharu discovered that libcurl was vulnerable to a cookie
leak when doing requests across domains with matching tails. curl did
not properly restrict cookies to domains and subdomains. If a user or
automated system were tricked into processing a specially crafted URL,
an attacker could read cookie values stored by unrelated webservers.
The problem can be corrected by updating your system to the following package versions:
In general, a standard system update will make all the necessary changes.