Curl shipped with 14.1 has security issues and bugs!

akschu · 02-11-2014, 07:23 PM

I've been battling a curl issue all morning, and updating to 7.35.0 fixes it. I would much rather use a stock slackware package so that I don't have slackpkg warning me to downgrade to the broken version in the repository.

Can someone update this and roll a security patch? It's just a matter of changing the version number and rebuilding the package.

Thanks,
schu

Richard Cranium · 02-11-2014, 08:49 PM

Well, "someone" would be Pat so maybe you should provide some details on the bugs that you found.

mancha · 02-11-2014, 09:21 PM

See http://www.linuxquestions.org/questi...ml#post5108614

--mancha

philanc · 02-11-2014, 11:28 PM

Quote:

Originally Posted by akschu

I've been battling a curl issue all morning, and updating to 7.35.0 fixes it. I would much rather use a stock slackware package so that I don't have slackpkg warning me to downgrade to the broken version in the repository.

If you have already updated curl to 7.35 and your immediate objective is to eliminate slackpkg warning or prompt about curl, you may just add 'curl' to /etc/slackpkg/blacklist for the time being.

Phil

1337_powerslacker · 02-12-2014, 10:43 PM

Quote:

Originally Posted by akschu

I've been battling a curl issue all morning, and updating to 7.35.0 fixes it. I would much rather use a stock slackware package so that I don't have slackpkg warning me to downgrade to the broken version in the repository.

Can someone update this and roll a security patch? It's just a matter of changing the version number and rebuilding the package.

Thanks,
schu

I used mancha's post as an opportunity to download the latest version of curl from its homepage, and compiled it myself. You can download the source here, and download the SlackBuild files that I have uploaded (gzipped tarball, just delete the '.txt' from the end of it).

Cheers,

Matt

chessmaster15 · 02-12-2014, 11:32 PM

Curl 7.35 is also in the PhantomX Git Slackbuilds.

STDOUBT · 02-13-2014, 10:56 PM

BAM. Check that changelog

tronayne · 02-14-2014, 09:02 AM

This morning's [slackware-security] curl (SSA:2014-044-01):

Quote:

Here are the details from the Slackware 14.1 ChangeLog:
+--------------------------+
patches/packages/curl-7.35.0-i486-1_slack14.1.txz: Upgraded.
This update fixes a flaw where libcurl could, in some circumstances, reuse
the wrong connection when asked to do an NTLM-authenticated HTTP or HTTPS
request.
For more information, see:
http://curl.haxx.se/docs/adv_20140129.html
http://cve.mitre.org/cgi-bin/cvename...=CVE-2014-0015
(* Security fix *)
+--------------------------+

Hope this helps some.

akschu · 02-16-2014, 04:03 PM

Thanks,

This is exactly what I was wanting. Sure I could build my own and blacklist the package in slackpkg (and did), but then I would need to pay attention to any future updates instead of relying on the Slackware user collective. This update fixes that.

schu