]> xenbits.xensource.com Git - qemu-upstream-4.2-testing.git/commit
block/curl: disable extra protocols to prevent CVE-2013-0249
authorStefan Hajnoczi <stefanha@redhat.com>
Fri, 8 Feb 2013 07:49:10 +0000 (08:49 +0100)
committerStefano Stabellini <stefano.stabellini@eu.citrix.com>
Wed, 4 Mar 2015 15:59:20 +0000 (15:59 +0000)
commitc2e7bd6374c56e9db5cf78bfdd71fe674608314a
tree2a59ef0c4dd371301479c7acbd1b728c398d5fe2
parent13902877580a9865b86a1521aa7577478f03afe2
block/curl: disable extra protocols to prevent CVE-2013-0249

There is a buffer overflow in libcurl POP3/SMTP/IMAP.  The workaround is
simple: disable extra protocols so that they cannot be exploited.  Full
details here:

  http://curl.haxx.se/docs/adv_20130206.html

QEMU only cares about HTTP, HTTPS, FTP, FTPS, and TFTP.  I have tested
that this fix prevents the exploit on my host with
libcurl-7.27.0-5.fc18.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
block/curl.c