[Secure-testing-team] Bug#859500: curl: CVE-2017-7407

[Salvatore Bonaccorso]

Source: curl
Version: 7.38.0-4
Severity: important
Tags: security patch upstream fixed-upstream

Hi,

the following vulnerability was published for curl.

CVE-2017-7407[0]:
| The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow
| physically proximate attackers to obtain sensitive information from
| process memory in opportunistic circumstances by reading a workstation
| screen during use of a --write-out argument ending in a '%' character,
| which leads to a heap-based buffer over-read.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-7407
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7407

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore