new file mode 100644

@@ -0,0 +1,34 @@

+From 57d299a499155d4b327e341c6024e293b0418243 Mon Sep 17 00:00:00 2001

+From: Daniel Stenberg <daniel@haxx.se>

+Date: Mon, 13 Aug 2018 10:35:52 +0200

+Subject: [PATCH] Curl_ntlm_core_mk_nt_hash: return error on too long password

+

+... since it would cause an integer overflow if longer than (max size_t

+/ 2).

+

+This is CVE-2018-14618

+

+Bug: https://curl.haxx.se/docs/CVE-2018-14618.html

+Closes #2756

+Reported-by: Zhaoyang Wu

+---

+ lib/curl_ntlm_core.c | 5 ++++-

+ 1 file changed, 4 insertions(+), 1 deletion(-)

+

+diff --git a/lib/curl_ntlm_core.c b/lib/curl_ntlm_core.c

+index e27cab353c..922e85a926 100644

+--- a/lib/curl_ntlm_core.c

+@@ -557,8 +557,11 @@ CURLcode Curl_ntlm_core_mk_nt_hash(struct Curl_easy *data,

+                                    unsigned char *ntbuffer /* 21 bytes */)

+ {

+   size_t len = strlen(password);

+-  unsigned char *pw = len ? malloc(len * 2) : strdup("");

++  unsigned char *pw;

+   CURLcode result;

++  if(len > SIZE_T_MAX/2) /* avoid integer overflow */

++    return CURLE_OUT_OF_MEMORY;

++  pw = len ? malloc(len * 2) : strdup("");

+   if(!pw)

+     return CURLE_OUT_OF_MEMORY;

+ 

new file mode 100644

@@ -0,0 +1,123 @@

+From c1366571b609407cf0d4d9f4a2769d29e1313151 Mon Sep 17 00:00:00 2001

+From: Daniel Stenberg <daniel@haxx.se>

+Date: Tue, 20 Mar 2018 15:15:14 +0100

+Subject: [PATCH] vauth/cleartext: fix integer overflow check

+

+Make the integer overflow check not rely on the undefined behavior that

+a size_t wraps around on overflow.

+

+Detected by lgtm.com

+Closes #2408

+---

+ lib/curl_ntlm_core.c  | 11 +----------

+ lib/curl_setup.h      |  9 +++++++++

+ lib/vauth/cleartext.c | 14 ++++----------

+ 3 files changed, 14 insertions(+), 20 deletions(-)

+

+diff --git a/lib/curl_ntlm_core.c b/lib/curl_ntlm_core.c

+index e8962769ca..72eda34ad1 100644

+--- a/lib/curl_ntlm_core.c

+@@ -5,7 +5,7 @@

+  *                            | (__| |_| |  _ <| |___

+  *                             \___|\___/|_| \_\_____|

+  *

+- * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.

++ * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.

+  *

+  * This software is licensed as described in the file COPYING, which

+  * you should have received as part of this distribution. The terms

+@@ -646,15 +646,6 @@ CURLcode Curl_hmac_md5(const unsigned char *key, unsigned int keylen,

+   return CURLE_OK;

+ }

+ 

+-#ifndef SIZE_T_MAX

+-/* some limits.h headers have this defined, some don't */

+-#if defined(SIZEOF_SIZE_T) && (SIZEOF_SIZE_T > 4)

+-#define SIZE_T_MAX 18446744073709551615U

+-#else

+-#define SIZE_T_MAX 4294967295U

+-#endif

+-#endif

+-

+ /* This creates the NTLMv2 hash by using NTLM hash as the key and Unicode

+  * (uppercase UserName + Domain) as the data

+  */

+diff --git a/lib/curl_setup.h b/lib/curl_setup.h

+index f128696e9d..e4503c64ca 100644

+--- a/lib/curl_setup.h

+@@ -447,6 +447,15 @@

+ #  endif

+ #endif

+ 

++#ifndef SIZE_T_MAX

++/* some limits.h headers have this defined, some don't */

++#if defined(SIZEOF_SIZE_T) && (SIZEOF_SIZE_T > 4)

++#define SIZE_T_MAX 18446744073709551615U

++#else

++#define SIZE_T_MAX 4294967295U

++#endif

++#endif

++

+ /*

+  * Arg 2 type for gethostname in case it hasn't been defined in config file.

+  */

+diff --git a/lib/vauth/cleartext.c b/lib/vauth/cleartext.c

+index a761ae7846..5d61ce6dc2 100644

+--- a/lib/vauth/cleartext.c

+@@ -5,7 +5,7 @@

+  *                            | (__| |_| |  _ <| |___

+  *                             \___|\___/|_| \_\_____|

+  *

+- * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.

++ * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.

+  *

+  * This software is licensed as described in the file COPYING, which

+  * you should have received as part of this distribution. The terms

+@@ -73,16 +73,10 @@ CURLcode Curl_auth_create_plain_message(struct Curl_easy *data,

+   ulen = strlen(userp);

+   plen = strlen(passwdp);

+ 

+-  /* Compute binary message length, checking for overflows. */

+-  plainlen = 2 * ulen;

+-  if(plainlen < ulen)

+-    return CURLE_OUT_OF_MEMORY;

+-  plainlen += plen;

+-  if(plainlen < plen)

+-    return CURLE_OUT_OF_MEMORY;

+-  plainlen += 2;

+-  if(plainlen < 2)

++  /* Compute binary message length. Check for overflows. */

++  if((ulen > SIZE_T_MAX/2) || (plen > (SIZE_T_MAX/2 - 2)))

+     return CURLE_OUT_OF_MEMORY;

++  plainlen = 2 * ulen + plen + 2;

+ 

+   plainauth = malloc(plainlen);

+   if(!plainauth)

+From f3a24d7916b9173c69a3e0ee790102993833d6c5 Mon Sep 17 00:00:00 2001

+From: Daniel Stenberg <daniel@haxx.se>

+Date: Fri, 28 Sep 2018 16:08:16 +0200

+Subject: [PATCH] Curl_auth_create_plain_message: fix too-large-input-check

+

+CVE-2018-16839

+Reported-by: Harry Sintonen

+Bug: https://curl.haxx.se/docs/CVE-2018-16839.html

+---

+ lib/vauth/cleartext.c | 2 +-

+ 1 file changed, 1 insertion(+), 1 deletion(-)

+

+diff --git a/lib/vauth/cleartext.c b/lib/vauth/cleartext.c

+index a10edbdc74..be6d6111e2 100644

+--- a/lib/vauth/cleartext.c

+@@ -74,7 +74,7 @@ CURLcode Curl_auth_create_plain_message(struct Curl_easy *data,

+   plen = strlen(passwdp);

+ 

+   /* Compute binary message length. Check for overflows. */

+-  if((ulen > SIZE_T_MAX/2) || (plen > (SIZE_T_MAX/2 - 2)))

++  if((ulen > SIZE_T_MAX/4) || (plen > (SIZE_T_MAX/2 - 2)))

+     return CURLE_OUT_OF_MEMORY;

+   plainlen = 2 * ulen + plen + 2;

+ 

new file mode 100644

@@ -0,0 +1,33 @@

+From 81d135d67155c5295b1033679c606165d4e28f3f Mon Sep 17 00:00:00 2001

+From: Daniel Stenberg <daniel@haxx.se>

+Date: Thu, 18 Oct 2018 15:07:15 +0200

+Subject: [PATCH] Curl_close: clear data->multi_easy on free to avoid

+ use-after-free

+

+Regression from b46cfbc068 (7.59.0)

+CVE-2018-16840

+Reported-by: Brian Carpenter (Geeknik Labs)

+

+Bug: https://curl.haxx.se/docs/CVE-2018-16840.html

+---

+ lib/url.c | 4 +++-

+ 1 file changed, 3 insertions(+), 1 deletion(-)

+

+diff --git a/lib/url.c b/lib/url.c

+index 723b898065..0d5a13f996 100644

+--- a/lib/url.c

+@@ -331,10 +331,12 @@ CURLcode Curl_close(struct Curl_easy *data)

+        and detach this handle from there. */

+     curl_multi_remove_handle(data->multi, data);

+ 

+-  if(data->multi_easy)

++  if(data->multi_easy) {

+     /* when curl_easy_perform() is used, it creates its own multi handle to

+        use and this is the one */

+     curl_multi_cleanup(data->multi_easy);

++    data->multi_easy = NULL;

++  }

+ 

+   /* Destroy the timeout list that is held in the easy handle. It is

+      /normally/ done by curl_multi_remove_handle() but this is "just in

new file mode 100644

@@ -0,0 +1,25 @@

+From d530e92f59ae9bb2d47066c3c460b25d2ffeb211 Mon Sep 17 00:00:00 2001

+From: Daniel Stenberg <daniel@haxx.se>

+Date: Sun, 28 Oct 2018 01:33:23 +0200

+Subject: [PATCH] voutf: fix bad arethmetic when outputting warnings to stderr

+

+CVE-2018-16842

+Reported-by: Brian Carpenter

+Bug: https://curl.haxx.se/docs/CVE-2018-16842.html

+---

+ src/tool_msgs.c | 2 +-

+ 1 file changed, 1 insertion(+), 1 deletion(-)

+

+diff --git a/src/tool_msgs.c b/src/tool_msgs.c

+index 832ed8147b..f5e1df25fb 100644

+--- a/src/tool_msgs.c

+@@ -67,7 +67,7 @@ static void voutf(struct GlobalConfig *config,

+         (void)fwrite(ptr, cut + 1, 1, config->errors);

+         fputs("\n", config->errors);

+         ptr += cut + 1; /* skip the space too */

+-        len -= cut;

++        len -= cut + 1;

+       }

+       else {

+         fputs(ptr, config->errors);

@@ -1,7 +1,7 @@

 Summary:        An URL retrieval utility and library

 Name:           curl

 Version:        7.59.0

-Release:        3%{?dist}

+Release:        4%{?dist}

 License:        MIT

 URL:            http://curl.haxx.se

 Group:          System Environment/NetworkingLibraries

@@ -12,6 +12,10 @@ Source0:        http://curl.haxx.se/download/%{name}-%{version}.tar.gz

 Patch0:         curl-CVE-2018-1000300.patch

 Patch1:         curl-CVE-2018-1000301.patch

 Patch2:         curl-CVE-2018-0500.patch

+Patch3:         curl-CVE-2018-16839.patch

+Patch4:         curl-CVE-2018-16840.patch

+Patch5:         curl-CVE-2018-16842.patch

+Patch6:         curl-CVE-2018-14618.patch

 BuildRequires:  ca-certificates

 BuildRequires:  openssl-devel

 BuildRequires:  krb5-devel

@@ -22,10 +26,10 @@ Requires:       krb5

 Requires:       libssh2

 Requires:       curl-libs = %{version}-%{release}

 %description

-The cURL package contains an utility and a library used for 

-transferring files with URL syntax to any of the following 

-protocols: FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, 

-DICT, LDAP, LDAPS and FILE. Its ability to both download and 

+The cURL package contains an utility and a library used for

+transferring files with URL syntax to any of the following

+protocols: FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET,

+DICT, LDAP, LDAPS and FILE. Its ability to both download and

 upload files can be incorporated into other programs to support

 functions like streaming media.

@@ -47,6 +51,11 @@ This package contains minimal set of shared curl libraries.

 %patch0 -p1

 %patch1 -p1

 %patch2 -p1

+%patch3 -p1

+%patch4 -p1

+%patch5 -p1

+%patch6 -p1

+

 %build

 ./configure \

     CFLAGS="%{optflags}" \

@@ -62,6 +71,7 @@ This package contains minimal set of shared curl libraries.

     --with-libssh2 \

     --with-ca-bundle=/etc/pki/tls/certs/ca-bundle.crt

 make %{?_smp_mflags}

+

 %install

 [ %{buildroot} != "/"] && rm -rf %{buildroot}/*

 make DESTDIR=%{buildroot} install

@@ -73,9 +83,12 @@ find %{buildroot}/%{_libdir} -name '*.la' -delete

 make %{?_smp_mflags} check

 %post   -p /sbin/ldconfig

+

 %postun -p /sbin/ldconfig

+

 %clean

 rm -rf %{buildroot}/*

+

 %files

 %defattr(-,root,root)

 %{_bindir}/*

@@ -94,6 +107,8 @@ rm -rf %{buildroot}/*

 %{_libdir}/libcurl.so.*

 %changelog

+*   Tue Jan 29 2019 Dweep Advani <dadvani@vmware.com> 7.59.0-4

+-   Fix for CVE-2018-16839, CVE-2018-16840, CVE-2018-16842 and CVE-2018-14618

 *   Tue Sep 18 2018 Keerthana K <keerthanak@vmware.com> 7.59.0-3

 -   Fix for CVE-2018-0500

 *   Thu Jul 05 2018 Keerthana K <keerthanak@vmware.com> 7.59.0-2