Secunia

A security issue has been reported in cURL / libcURL, which can potentially be exploited by malicious people to cause a DoS (Denial of Service) or compromise an application using the library.

The security issue is caused due to an error when returning data to the registered callback function for downloading compressed content over HTTP. The library may send back up to 64Kb of data to the callback function, exceeding the documented maximum data size of 16Kb (CURL_MAX_WRITE_SIZE). This can potentially lead to buffer overflows in client applications.

NOTE: This only affects zlib-enabled builds where automatic decompression has been enabled (disabled by default).

The security issue affects curl and libcurl versions 7.10.5 through 7.19.7.

Solution
Update to version 7.20.0 or apply the patch.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Wesley Miaw.

Changelog
Further details available in Customer Area

Original Advisory
http://curl.haxx.se/docs/adv_20100209.html

Deep Links
Links available in Customer Area