lftp is affected by curl CVE-2014-0139

Vitezslav Cizek <[email protected]> Tue, 9 Dec 2014 18:46:32 +0100

Newsgroups	gmane.network.lftp.user
Organization	SUSE Linux s.r.o.
Message-ID	<[email protected]>

Hi,
I've noticed lftp is using code borrowed from curl.
That makes lftp affected by CVE-2014-0139:
http://curl.haxx.se/docs/adv_20140326B.html

It's not the most critical vulnerability, but anyway,
I'll suggest to update to code from latest curl for the next release.

-- 
Vita Cizek

_______________________________________________
lftp mailing list
[email protected]
http://univ.uniyar.ac.ru/mailman/listinfo/lftp

signature.asc (application/pgp-signature, 819 B)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJUhzVxAAoJEPVDUqZLsdGT2b8P/1R911RIaEil8q4Xo40+tylm
GngOk04b5xuC7NLV9S+UUsOIzWD8GGBZTsgP257rjS43PoQ8ozWBVXq8R8brYsJO
QpDk5iMMj85aFna1r9eDZAxRtzwYA/o9RHTCDQ48gHtcKxfsSrAZhWmXUIgo8tTT
vqy/WTc517A8GOHYqWpBpjHqkddRJRphXHGQb8s4q7iF2gHxmkPRFgVzNmYj2fAJ
v+bClcFpLTmJ6OnzQTfm++t6ni41Zr32k0rwT6x2tC1FWK2DM0WtHtJ42z+J5le1
SSB/0KWyZO5Nqep2+t3cK3azRc9/b9avq5KxLz0pqyRA9nUSAMQur+/dX8clhF7f
L9DfcW2GJ1ER+/4ixCasmA37M8Ial4X4pnbd62SITtCkeEV7aFOpZp46+c7yOWHx
f0X1w9tJE2d9LUjNwFpRzXWVf9eEYvUQ/XxY69y9hoPHKxkc93fshpr3ihaPFdis
Z1GfhnJk2h0i17sxFiwLj0sMldY3wO5358M8odBFXBtf1mul5RDwCiGER3Tc1bRp
lCLnyU8rFXCVnJu8Swl3tqsIqnNRdwxmOF1jeulWxPbAkQsjH2aDfhgjD3fDy9JO
X+FXFft7fvah3gh/pAH9JPShWbukPojneVo/ef9C58PGFhgPxNRqO7qw2ZT8HEV+
LE2ECMb3Yl6jJYmWoq2c
=moaF
-----END PGP SIGNATURE-----