<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for curl</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2018:2714-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2018-09-14T10:46:42Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2018-09-14T10:46:42Z</InitialReleaseDate>
    <CurrentReleaseDate>2018-09-14T10:46:42Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for curl</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for curl fixes the following issues:

This security issue was fixed:

- CVE-2018-14618: Prevent integer overflow in the NTLM authentication code
  (bsc#1106019)

This non-security issue was fixed:

- Use OPENSSL_config instead of CONF_modules_load_file() to avoid crashes due
  to openssl engines conflicts (bsc#1086367)
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-SLE-Module-Basesystem-15-2018-1904</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20182714-1/</URL>
      <Description>Link for SUSE-SU-2018:2714-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2018-September/004560.html</URL>
      <Description>E-Mail link for SUSE-SU-2018:2714-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1086367</URL>
      <Description>SUSE Bug 1086367</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1106019</URL>
      <Description>SUSE Bug 1106019</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-14618/</URL>
      <Description>SUSE CVE CVE-2018-14618 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Basesystem 15">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Basesystem 15">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15" CPE="cpe:/o:suse:sle-module-basesystem:15">SUSE Linux Enterprise Module for Basesystem 15</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="curl-7.60.0-3.9.1">
      <FullProductName ProductID="curl-7.60.0-3.9.1">curl-7.60.0-3.9.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libcurl-devel-7.60.0-3.9.1">
      <FullProductName ProductID="libcurl-devel-7.60.0-3.9.1">libcurl-devel-7.60.0-3.9.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libcurl4-7.60.0-3.9.1">
      <FullProductName ProductID="libcurl4-7.60.0-3.9.1">libcurl4-7.60.0-3.9.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libcurl4-32bit-7.60.0-3.9.1">
      <FullProductName ProductID="libcurl4-32bit-7.60.0-3.9.1">libcurl4-32bit-7.60.0-3.9.1</FullProductName>
    </Branch>
    <Relationship ProductReference="curl-7.60.0-3.9.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15:curl-7.60.0-3.9.1">curl-7.60.0-3.9.1 as a component of SUSE Linux Enterprise Module for Basesystem 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="libcurl-devel-7.60.0-3.9.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15:libcurl-devel-7.60.0-3.9.1">libcurl-devel-7.60.0-3.9.1 as a component of SUSE Linux Enterprise Module for Basesystem 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="libcurl4-7.60.0-3.9.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15:libcurl4-7.60.0-3.9.1">libcurl4-7.60.0-3.9.1 as a component of SUSE Linux Enterprise Module for Basesystem 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="libcurl4-32bit-7.60.0-3.9.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15:libcurl4-32bit-7.60.0-3.9.1">libcurl4-32bit-7.60.0-3.9.1 as a component of SUSE Linux Enterprise Module for Basesystem 15</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)</Note>
    </Notes>
    <CVE>CVE-2018-14618</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:curl-7.60.0-3.9.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libcurl-devel-7.60.0-3.9.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libcurl4-32bit-7.60.0-3.9.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libcurl4-7.60.0-3.9.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>10</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:C/I:C/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20182714-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-14618.html</URL>
        <Description>CVE-2018-14618</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1106019</URL>
        <Description>SUSE Bug 1106019</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1112758</URL>
        <Description>SUSE Bug 1112758</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1122464</URL>
        <Description>SUSE Bug 1122464</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
