Chapter 3. Security Fixes

This update includes fixes for the following security related issues:

Expand

ID	Impact	Summary
CVE-2018-0495	Moderate	openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries
CVE-2018-0732	Moderate	openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client to hang
CVE-2018-14404	Moderate	libxml2: NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can allow attackers to cause a denial of service
CVE-2018-16890	Moderate	curl: NTLM type-2 heap out-of-bounds buffer read
CVE-2018-1000005	Low	curl: Out-of-bounds read in code handling HTTP/2 trailers
CVE-2018-1000007	Moderate	curl: HTTP authentication leak in redirects
CVE-2018-1000120	Moderate	curl: FTP path trickery leads to NIL byte out of bounds write
CVE-2018-1000122	Moderate	curl: RTSP RTP buffer over-read
CVE-2019-0211	Important	httpd: privilege escalation from modules scripts
CVE-2019-3822	Moderate	curl: NTLMv2 type-3 header stack buffer overflow
CVE-2019-3823	Low	curl: SMTP end-of-response out-of-bounds read