-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathchangelog
2761 lines (1912 loc) · 98 KB
/
changelog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
curl (7.81.0-1ubuntu1.20) jammy-security; urgency=medium
* SECURITY UPDATE: netrc and redirect credential leak
- debian/patches/CVE-2024-11053-pre1.patch: use same credentials on
redirect in lib/transfer.c, lib/url.c, lib/urldata.h,
tests/data/Makefile.inc, tests/data/test998, tests/data/test999.
- debian/patches/CVE-2024-11053.patch: address several netrc parser
flaws in lib/netrc.c, lib/url.c, tests/data/Makefile.inc,
tests/data/test478, tests/data/test479, tests/data/test480,
tests/unit/unit1304.c, tests/data/DISABLED.
- CVE-2024-11053
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 11 Dec 2024 12:26:37 -0500
curl (7.81.0-1ubuntu1.19) jammy-security; urgency=medium
* SECURITY UPDATE: HSTS expiry overwrites parent cache entry.
- debian/patches/CVE-2024-9681.patch: Add bestsub, blen, and hostname
comparison in lib/hsts.c.
- CVE-2024-9681
-- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com> Wed, 06 Nov 2024 10:54:59 -0330
curl (7.81.0-1ubuntu1.18) jammy-security; urgency=medium
* SECURITY UPDATE: OCSP stapling bypass with GnuTLS
- debian/patches/CVE-2024-8096.patch: fix OCSP stapling management in
lib/vtls/gtls.c.
- CVE-2024-8096
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Fri, 06 Sep 2024 07:38:40 -0400
curl (7.81.0-1ubuntu1.17) jammy-security; urgency=medium
* SECURITY UPDATE: ASN.1 date parser overread
- debian/patches/CVE-2024-7264-pre1.patch: clean up GTime2str in
lib/x509asn1.c.
- debian/patches/CVE-2024-7264.patch: unittests and fixes for gtime2str
in lib/x509asn1.c, lib/x509asn1.h, tests/data/Makefile.inc,
tests/data/test1656, tests/unit/Makefile.inc, tests/unit/unit1656.c.
- CVE-2024-7264
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Thu, 01 Aug 2024 09:51:30 -0400
curl (7.81.0-1ubuntu1.16) jammy-security; urgency=medium
* SECURITY UPDATE: HTTP/2 push headers memory-leak
- debian/patches/CVE-2024-2398.patch: push headers better cleanup in
lib/http2.c.
- CVE-2024-2398
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Tue, 19 Mar 2024 08:16:19 -0400
curl (7.81.0-1ubuntu1.15) jammy-security; urgency=medium
* SECURITY UPDATE: cookie mixed case PSL bypass
- debian/patches/CVE-2023-46218.patch: lowercase the domain names
before PSL checks in lib/cookie.c.
- CVE-2023-46218
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 29 Nov 2023 14:23:00 -0500
curl (7.81.0-1ubuntu1.14) jammy-security; urgency=medium
* SECURITY UPDATE: SOCKS5 heap buffer overflow
- debian/patches/CVE-2023-38545.patch: return error if hostname too
long for remote resolve in lib/socks.c, tests/data/Makefile.inc,
tests/data/test728.
- CVE-2023-38545
* SECURITY UPDATE: cookie injection with none file
- debian/patches/CVE-2023-38546.patch: remove unnecessary struct fields
in lib/cookie.c, lib/cookie.h, lib/easy.c.
- CVE-2023-38546
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Tue, 03 Oct 2023 13:15:41 -0400
curl (7.81.0-1ubuntu1.13) jammy-security; urgency=medium
* SECURITY REGRESSION: broken ssl cert wildcard handling (LP: #2028170)
- debian/patches/CVE-2023-28321.patch: fix missing line in backport.
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 19 Jul 2023 12:23:36 -0400
curl (7.81.0-1ubuntu1.11) jammy-security; urgency=medium
* SECURITY UPDATE: improper certificate validation vulnerability
- debian/patches/CVE-2023-28321.patch: fix host name wildcard checking
in lib/hostcheck.c, tests/data/test1397, tests/unit/unit1397.c.
- CVE-2023-28321
* SECURITY UPDATE: information disclosure vulnerability
- debian/patches/CVE-2023-28322.patch: unify the upload/method handling
in lib/curl_rtmp.c, lib/file.c, lib/ftp.c, lib/http.c, lib/imap.c,
lib/rtsp.c, lib/setopt.c, lib/smb.c, lib/smtp.c, lib/tftp.c,
lib/transfer.c, lib/urldata.h, lib/vssh/libssh.c, lib/vssh/libssh2.c,
lib/vssh/wolfssh.c.
- CVE-2023-28322
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Mon, 17 Jul 2023 10:25:41 -0400
curl (7.81.0-1ubuntu1.10) jammy-security; urgency=medium
* SECURITY UPDATE: TELNET option IAC injection
- debian/patches/CVE-2023-27533.patch: only accept option arguments in
ascii in lib/telnet.c.
- CVE-2023-27533
* SECURITY UPDATE: SFTP path ~ resolving discrepancy
- debian/patches/CVE-2023-27534-pre1.patch: do not add '/' if homedir
ends with one in lib/curl_path.c.
- debian/patches/CVE-2023-27534.patch: create the new path with dynbuf
in lib/curl_path.c.
- CVE-2023-27534
* SECURITY UPDATE: FTP too eager connection reuse
- debian/patches/CVE-2023-27535-pre1.patch: add and use Curl_timestrcmp
in lib/netrc.c, lib/strcase.c, lib/strcase.h, lib/url.c,
lib/vauth/digest_sspi.c, lib/vtls/vtls.c.
- debian/patches/CVE-2023-27535.patch: add more conditions for
connection reuse in lib/ftp.c, lib/ftp.h, lib/url.c, lib/urldata.h.
- CVE-2023-27535
* SECURITY UPDATE: GSS delegation too eager connection re-use
- debian/patches/CVE-2023-27536.patch: only reuse connections with same
GSS delegation in lib/url.c, lib/urldata.h.
- CVE-2023-27536
* SECURITY UPDATE: SSH connection too eager reuse still
- debian/patches/CVE-2023-27538.patch: fix the SSH connection reuse
check in lib/url.c.
- CVE-2023-27538
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Tue, 14 Mar 2023 12:37:02 -0400
curl (7.81.0-1ubuntu1.8) jammy-security; urgency=medium
* SECURITY UPDATE: multiple HSTS issues
- debian/patches/CVE-2023-23914_5-1.patch: add sharing of HSTS cache
among handles in docs/libcurl/opts/CURLSHOPT_SHARE.3,
docs/libcurl/symbols-in-versions, include/curl/curl.h, lib/hsts.c,
lib/hsts.h, lib/setopt.c, lib/share.c, lib/share.h, lib/transfer.c,
lib/url.c, lib/urldata.h.
- debian/patches/CVE-2023-23914_5-2.patch: share HSTS between handles
in src/tool_operate.c.
- debian/patches/CVE-2023-23914_5-3.patch: handle adding the same host
name again in lib/hsts.c.
- debian/patches/CVE-2023-23914_5-4.patch: support crlf="yes" for
verify/proxy in tests/FILEFORMAT.md, tests/runtests.pl.
- debian/patches/CVE-2023-23914_5-5.patch: verify hsts with two URLs in
tests/data/Makefile.inc, tests/data/test446.
- CVE-2023-23914
- CVE-2023-23915
* SECURITY UPDATE: HTTP multi-header compression denial of service
- debian/patches/CVE-2023-23916-pre1.patch: do CRLF replacements in
tests/FILEFORMAT.md, tests/data/test1, tests/runtests.pl.
- debian/patches/CVE-2023-23916.patch: do not reset stage counter for
each header in lib/content_encoding.c, lib/urldata.h,
tests/data/Makefile.inc, tests/data/test418.
- CVE-2023-23916
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 15 Feb 2023 08:20:05 -0500
curl (7.81.0-1ubuntu1.7) jammy-security; urgency=medium
* SECURITY UPDATE: Another HSTS bypass via IDN
- debian/patches/CVE-2022-43551.patch: use the IDN decoded name in HSTS
checks in lib/http.c.
- CVE-2022-43551
* SECURITY UPDATE: HTTP Proxy deny use-after-free
- debian/patches/CVE-2022-43552.patch: do not free the protocol struct
in *_done() in lib/smb.c, lib/telnet.c.
- CVE-2022-43552
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 04 Jan 2023 09:53:07 -0500
curl (7.81.0-1ubuntu1.6) jammy-security; urgency=medium
* SECURITY UPDATE: POST following PUT confusion
- debian/patches/CVE-2022-32221.patch: when POST is set, reset the
'upload' field in lib/setopt.c.
- CVE-2022-32221
* SECURITY UPDATE: HTTP proxy double-free
- debian/patches/CVE-2022-42915.patch: restore the protocol pointer on
error in lib/http_proxy.c, lib/url.c.
- CVE-2022-42915
* SECURITY UPDATE: HSTS bypass via IDN
- debian/patches/CVE-2022-42916.patch: use IDN decoded names for HSTS
checks in lib/url.c.
- CVE-2022-42916
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Tue, 18 Oct 2022 12:35:33 -0400
curl (7.81.0-1ubuntu1.4) jammy-security; urgency=medium
* SECURITY UPDATE: when curl sends back cookies with control bytes a
HTTP(S) server may return a 400 response
- debian/patches/CVE-2022-35252.patch: adds invalid_octets function
to lib/cookie.c to reject cookies with control bytes
- CVE-2022-35252
-- Mark Esler <mark.esler@canonical.com> Wed, 31 Aug 2022 14:18:07 -0500
curl (7.81.0-1ubuntu1.3) jammy-security; urgency=medium
* SECURITY UPDATE: Set-cookie denial of service
- debian/patches/CVE-2022-32205.patch: apply limits to cookies
specifications in lib/cookie.c, lib/cookie.h, lib/http.c, lib/urldata.h.
- CVE-2022-32205
* SECURITY UPDATE: HTTP compression denial of service
- debian/patches/CVE-2022-32206.patch: return error on too many
compression steps in lib/content_encoding.c.
- CVE-2022-32206
* SECURITY UPDATE: Unpreserved file permissions
- debian/patches/CVE-2022-32207.patch: add Curl_fopen()
for better overwriting of files in lib/Makefile.inc,
lib/cookie.c, lib/fopen.c, lib/fopen.h.
- CVE-2022-32207
* SECURITY UPDATE: FTP-KRB bad msg verification
- debian/patches/CVE-2022-32208.patch: return error properly
on decode errors in lib/krb5.c.
- CVE-2022-32208
-- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com> Mon, 20 Jun 2022 15:08:01 -0300
curl (7.81.0-1ubuntu1.2) jammy-security; urgency=medium
* SECURITY UPDATE: percent-encoded path separator in URL host
- debian/patches/CVE-2022-27780.patch: reject percent-decoding host
name into separator bytes in lib/urlapi.c.
- CVE-2022-27780
* SECURITY UPDATE: CERTINFO never-ending busy-loop
- debian/patches/CVE-2022-27781.patch: return error if seemingly stuck
in a cert loop in lib/vtls/nss.c.
- CVE-2022-27781
* SECURITY UPDATE: TLS and SSH connection too eager reuse
- debian/patches/CVE-2022-27782.patch: check more TLS details for
connection reuse in lib/setopt.c, lib/url.c, lib/urldata.h,
lib/vtls/gtls.c, lib/vtls/openssl.c, lib/vtls/nss.c, lib/vtls/vtls.c,
lib/vssh/ssh.h.
- CVE-2022-27782
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Mon, 09 May 2022 08:34:24 -0400
curl (7.81.0-1ubuntu1.1) jammy-security; urgency=medium
* SECURITY UPDATE: OAUTH2 bypass
- debian/patches/CVE-2022-22576.patch: check sasl additional
parameters for conn resuse in lib/strcase.c, lib/strcase.h,
lib/url.c, lib/urldata.h, lib/vtls/vtls.c.
- CVE-2022-22576
* SECURITY UPDATE: Credential leak on redirect
- debian/patches/CVE-2022-27774-1.patch: store conn_remote_port
in the info struct to make it available after the connection ended
in lib/connect.c, lib/urldata.h.
- debian/patches/CVE-2022-27774-2.patch: redirects to other protocols
or ports clear auth in lib/transfer.c.
- debian/patches/CVE-2022-27774-3.patch: adds tests to verify
these fix in tests/data/Makefile.inc, tests/data/test973,
tests/data/test974, tests/data/test975, tests/data/test976.
- CVE-2022-27774
* SECURITY UPDATE: Bad local IPV6 connection reuse
- debian/patches/CVE-2022-27775.patch: include the zone id in the
'bundle' haskey in lib/conncache.c.
- CVE-2022-27775
* SECURITY UPDATE: Auth/cookie leak on redirect
- debian/patches/CVE-2022-27776.patch: avoid auth/cookie on redirects
same host diff port in lib/http.c, lib/urldata.h.
- CVE-2022-27776
-- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com> Wed, 20 Apr 2022 11:50:18 -0300
curl (7.81.0-1) unstable; urgency=medium
* New upstream version 7.81.0
* d/p/13_fix-man-formatting.patch: Refresh patch
-- Samuel Henrique <samueloph@debian.org> Wed, 05 Jan 2022 09:31:32 -0300
curl (7.80.0-3) unstable; urgency=medium
* Revert "Revert "debian/control: Add Build-Depends on libssh-dev for
Ubuntu".
As per #1002598, the blocker has been solved.
Note that this does not changes Debian's curl to libssh, it still
uses libssh2.
Discussions about changing to libssh are ongoing at #897950
-- Samuel Henrique <samueloph@debian.org> Sun, 26 Dec 2021 13:22:18 -0300
curl (7.80.0-2) unstable; urgency=medium
* Revert "debian/control: Add Build-Depends on libssh-dev for Ubuntu"
(closes: #1002597)
The change had side effects on Debian due to the inclusion of the new
Build-dep, even though it doesn't changes the resulting binary. It cause
issues for architecture bootstraping.
We are gonna reintroduce this change once the issues are fixed, to allow
Ubuntu to remove its delta.
See discussions at #1002598 and #1002597 for details
-- Samuel Henrique <samueloph@debian.org> Sat, 25 Dec 2021 10:47:13 -0300
curl (7.80.0-1) unstable; urgency=medium
[ Samuel Henrique ]
* New upstream version 7.80.0
* Bump Standards-Version to 4.6.0
* Add new symbol curl_url_strerror to symbols files
* Compile with zstd support (closes: #983660)
* d/p/12_use-python3-in-tests.patch: Drop patch, merged upstream
* d/p/13_fix-man-formatting.patch: Update patch
* d/p/14_fix-compatibility-impacket-0-9-23.patch: Drop patch, merged upstream
[ Jeremy Bicha ]
* debian/control: Add Build-Depends on libssh-dev for Ubuntu
-- Samuel Henrique <samueloph@debian.org> Fri, 24 Dec 2021 11:42:57 -0300
curl (7.79.1-2) unstable; urgency=medium
* d/rules: Make test failures non-fatal again.
Unfortunately there are some test failures happening on a few
architectures, so we have to make the build pass even if not all tests
are succeeding, at least until we have time to properly investigate
the reason for these failures.
-- Sergio Durigan Junior <sergiodj@debian.org> Mon, 08 Nov 2021 23:54:35 -0500
curl (7.79.1-1) unstable; urgency=medium
[ Samuel Henrique ]
* Add myself as an Uploader
* Add sergiodj as an uploader
* New upstream version 7.79.1 (closes: #989046)
- Changes since 7.74.0:
~ vtls: fix connection reuse checks for issuer cert and case sensitivity
(closes: #991492, CVE-2021-22924)
~ Fix User-Agent header missing in some cases (closes: #994940)
~ Fix TELNET stack contents disclosure (closes: #989228, CVE-2021-22898)
* d/rules: Add --with-{openssl|gnutls|nss} to configure args
* Update all patches.
Remove patches:
- 07_do-not-disable-debug-symbols: Obsolete as per
https://github.com/curl/curl/issues/7216.
- 14_transfer-strip-credentials-from-the-auto-referer-hea:
Originally from upstream, part of the release now.
- 15_vtls-add-isproxy-argument-to-Curl_ssl_get-addsession:
Originally from upstream, part of the release now.
- fix-regression-microseconds-instead-of-seconds:
Originally from upstream, part of the release now.
Update patches:
- 12_use-python3-in-tests: Update and forward upstream.
- 90_gnutls: Update
- 99_nss: Update
- 13_fix-man-formatting: Update
[ Debian Janitor ]
* Use secure URI in Homepage field.
* Set debhelper-compat version in Build-Depends.
* Set upstream metadata fields: Bug-Database,
Bug-Submit (from ./configure), Repository, Repository-Browse.
* Avoid explicitly specifying -Wl,--as-needed linker flag.
[ Helmut Grohne ]
* Also remove -ffile-prefix-map from curl-config (closes: #990128)
* Explicitly disable zstd support (closes: #992505)
[ Sergio Durigan Junior ]
* d/control: Add Rules-Requires-Root: no.
* d/copyright: Add public-domain license text.
* Enable GPG-checking of orig tarball.
- d/upstream/signing-key.asc: Upstream public key.
- d/watch: Add "pgpmode=auto" as an option.
* Bump debhelper-compat to 13.
- d/control: B-D on debhelper-compat = 13.
- d/rules: After the override_dh_auto_install target has been run,
we know that we can safely get rid of the contents inside the
debian/tmp/ directory. This is needed because otherwise dh_missing
will complain about uninstalled files, which will make the build
fail when using debhelper-compat 13.
* d/rules: Some minor cleanup and removal of unneeded comments.
* d/rules: Honour "nocheck" build option.
* Make OpenSSL and GNUTLS builds fail if tests fail
- d/rules: Adjust rule to make OpenSSL and GNUTLS builds fail if their
tests fail. Unfortunately, it's still not possible to make the NSS
build fail if its tests fail; we're still investigating the failures
there with it.
- d/p/14_fix-compatibility-impacket-0-9-23.patch: Needed patch
to make tests pass with impacket 0.9.23+.
-- Samuel Henrique <samueloph@debian.org> Mon, 08 Nov 2021 21:14:47 +0000
curl (7.74.0-1.3) unstable; urgency=medium
* Non-maintainer upload.
* Add upstream patch bc7ecc7 so curl -w times shown as seconds with
fractions (Closes: #989064)
-- Paul Gevers <elbrus@debian.org> Fri, 25 Jun 2021 20:59:54 +0200
curl (7.74.0-1.2) unstable; urgency=medium
* Non-maintainer upload.
* transfer: strip credentials from the auto-referer header field
(CVE-2021-22876) (Closes: #986269)
* vtls: add 'isproxy' argument to Curl_ssl_get/addsessionid()
(CVE-2021-22890) (Closes: #986270)
-- Salvatore Bonaccorso <carnil@debian.org> Sat, 03 Apr 2021 14:43:39 +0200
curl (7.74.0-1.1) unstable; urgency=medium
* Non-maintainer upload.
[ Bruno Kleinert ]
* Fixed "Please build-depend on libidn2-dev instead of obsolete transition
package libidn2-0-dev" (Closes: #974996)
-- Samuel Henrique <samueloph@debian.org> Wed, 10 Feb 2021 00:42:40 +0000
curl (7.74.0-1) unstable; urgency=medium
* New upstream release
+ Fix inferior OCSP verification as per CVE-2020-8286 (Closes: #977161)
https://curl.se/docs/CVE-2020-8286.html
+ Fix FTP wildcard stack overflow as per CVE-2020-8285 (Closes: #977162)
https://curl.se/docs/CVE-2020-8285.html
+ Fix trusting FTP PASV responses as per CVE-2020-8284 (Closes: #977163)
https://curl.se/docs/CVE-2020-8284.html
* Update debian/watch to new upstream download page layout
* Update 12_use-python3-in-tests.patch due to renamed file
* Refresh patches
* Fix cross-build due to python build dependencies.
Thanks to Helmut Grohne for the patch (Closes: #969004)
* Fix formatting in some man pages.
Thanks to Bjarni Ingi Gislason for the patch (Closes: #963559)
* Update list of documentation files to install
* Update symbols
* Bump Standards-Version to 4.5.1 (no changes needed)
* Drop removed file from d/copyright
-- Alessandro Ghedini <ghedo@debian.org> Thu, 31 Dec 2020 15:22:05 +0100
curl (7.72.0-1) unstable; urgency=medium
* New upstream release
+ Fix partial password leak over DNS on HTTP redirect as per CVE-2020-8169
(Closes: #965280)
https://curl.haxx.se/docs/CVE-2020-8169.html
+ Fix local file overwrite with -J option as per CVE-2020-8177
(Closes: #965281)
https://curl.haxx.se/docs/CVE-2020-8177.html
+ Fix wrong connect-only connection as per CVE-2020-8231 (Closes: #968831)
https://curl.haxx.se/docs/CVE-2020-8231.html
* Refresh patches
* Do not install *.la files.
Thanks to Pino Toscano for the patch. (Closes: #955785)
* Update list of doc files
* Update copyright for polarssl -> mbedtls rename
* Use python3 executable in tests
-- Alessandro Ghedini <ghedo@debian.org> Mon, 24 Aug 2020 10:26:12 +0200
curl (7.68.0-1) unstable; urgency=medium
* New upstream release
* Bump Standards-Version to 4.5.0 (no changes needed)
* Update symbols files
* Configure default CA file with OpenSSL again (Closes: #948441)
-- Alessandro Ghedini <ghedo@debian.org> Sat, 22 Feb 2020 14:37:19 +0000
curl (7.67.0-2) unstable; urgency=medium
* Restore :native annotation for python3 Build-Depends.
Thanks to Helmut Grohne for the patch (Closes: #945928)
-- Alessandro Ghedini <ghedo@debian.org> Sun, 01 Dec 2019 13:29:28 +0000
curl (7.67.0-1) unstable; urgency=medium
* New upstream release
* Replace python with python3 in Build-Depends (Closes: #942984)
* Bump Standards-Version to 4.4.1 (no changes needed)
-- Alessandro Ghedini <ghedo@debian.org> Sat, 30 Nov 2019 12:45:07 +0000
curl (7.66.0-1) unstable; urgency=medium
* New upstream release (Closes: #940024)
+ Fix FTP-KRB double-free as per CVE-2019-5481 (Closes: #940009)
https://curl.haxx.se/docs/CVE-2019-5481.html
+ Fix TFTP small blocksize heap buffer overflow as per CVE-2019-5482
(Closes: #940010)
https://curl.haxx.se/docs/CVE-2019-5482.html
* Refresh patches
* Enable brotli support (Closes: #940129)
* Update *.symbols files
-- Alessandro Ghedini <ghedo@debian.org> Sun, 15 Sep 2019 15:47:05 +0100
curl (7.65.3-1) unstable; urgency=medium
* New upstream release
* Drop 12_fix-man-errors.patch (merged upstream)
* Remove Ian Jackson from Uploaders as he has never done an upload
-- Alessandro Ghedini <ghedo@debian.org> Fri, 09 Aug 2019 19:45:02 +0100
curl (7.65.1-1) unstable; urgency=medium
* New upstream release
+ Reduce verbose output (Closes: #926148)
+ Fix parsing URLs with link local addresses (Closes: #926812)
* Drop patches merged upstream
* Refresh patches
* Bump STandards-Version to 4.4.0 (no changes needed)
* Update entry in copyright for renamed files
* Fix some man errors.
Thanks to Bjarni Ingi Gislason for the patch (Closes: #926352)
* Add Build-Depends-Package field to symbols files
-- Alessandro Ghedini <ghedo@debian.org> Sat, 13 Jul 2019 12:37:09 +0100
curl (7.64.0-4) unstable; urgency=medium
* Fix TFTP receive buffer overflow as per CVE-2019-5436 (Closes: #929351)
https://curl.haxx.se/docs/CVE-2019-5436.html
* Fix integer overflow in curl_url_set() as per CVE-2019-5435 (Closes: #929352)
https://curl.haxx.se/docs/CVE-2019-5435.html
-- Alessandro Ghedini <ghedo@debian.org> Fri, 14 Jun 2019 19:23:32 +0100
curl (7.64.0-3) unstable; urgency=medium
* Fix potential crash in HTTP/2 code and busy loop at the end of connections
(Closes: #927471)
-- Alessandro Ghedini <ghedo@debian.org> Sat, 04 May 2019 12:51:06 +0100
curl (7.64.0-2) unstable; urgency=medium
* Fix infinite loop when fetching URLs with unreachable IPv6 (Closes: #922554)
-- Alessandro Ghedini <ghedo@debian.org> Thu, 07 Mar 2019 20:02:35 +0000
curl (7.64.0-1) unstable; urgency=medium
* New upstream release
+ Fix NTLM type-2 out-of-bounds buffer read as per CVE-2018-16890
https://curl.haxx.se/docs/CVE-2018-16890.html
+ Fix NTLMv2 type-3 header stack buffer overflow as per CVE-2019-3822
https://curl.haxx.se/docs/CVE-2019-3822.html
+ Fix SMTP end-of-response out-of-bounds read as per CVE-2019-3823
https://curl.haxx.se/docs/CVE-2019-3823.html
+ Fix HTTP negotiation with POST requests (Closes: #920267)
* Refresh patches
* Import fixes for zsh completion script generator (Closes: #92145)
-- Alessandro Ghedini <ghedo@debian.org> Wed, 06 Feb 2019 22:33:05 +0000
curl (7.63.0-1) unstable; urgency=medium
* New upstream release
+ Fix IPv6 numeral address parser (Closes: #915520)
+ Fix timeout handling (Closes: #914793)
+ Fix HTTP auth to include query in URI (Closes: #913214)
* Drop 12_fix-runtests-curl.patch (merged upstream)
* Update symbols
* Update copyright for removed files
* Bump debhlper compat level to 12
* Bump Standards-Version to 4.3.0 (no changes needed)
-- Alessandro Ghedini <ghedo@debian.org> Tue, 15 Jan 2019 20:47:40 +0000
curl (7.62.0-1) unstable; urgency=medium
* New upstream release
+ Fix NTLM password overflow via integer overflow as per CVE-2018-14618
(Closes: #908327) https://curl.haxx.se/docs/CVE-2018-14618.html
+ Fix SASL password overflow via integer overflow as per CVE-2018-16839
https://curl.haxx.se/docs/CVE-2018-16839.html
+ Fix use-after-free in handle close as per CVE-2018-16840
https://curl.haxx.se/docs/CVE-2018-16840.html
+ Fix warning message out-of-buffer read as per CVE-2018-16842
https://curl.haxx.se/docs/CVE-2018-16842.html
+ Fix broken terminal output (closes: #911333)
* Refresh patches
* Add 12_fix-runtests-curl.patch to fix running curl in tests
-- Alessandro Ghedini <ghedo@debian.org> Wed, 31 Oct 2018 22:42:44 +0000
curl (7.61.0-1) unstable; urgency=medium
* New upstream release
+ Fix SMTP send heap buffer overflow as per CVE-2018-0500 (Closes: #903546)
https://curl.haxx.se/docs/adv_2018-70a2.html
+ Fix some crashes related to HTTP/2 (Closes: #902628)
* Disable libssh2 on Ubuntu.
Thanks to Gianfranco Costamagna for the patch (Closes: #888449)
* Bump Standards-Version to 4.2.0 (no changes needed)
* Don't configure default CA bundle with OpenSSL and GnuTLS (Closes: #883174)
-- Alessandro Ghedini <ghedo@debian.org> Sat, 11 Aug 2018 13:32:28 +0100
curl (7.60.0-2) unstable; urgency=medium
[ Steve Langasek ]
* Build-depend on libssl-dev instead of libssl1.0-dev.
* Rename libcurl3 to libcurl4, because libcurl exposes an SSL_CTX via
CURLOPT_SSL_CTX_FUNCTION, and this object changes incompatibly between
openssl 1.0 and openssl 1.1.
* debian/patches/03_keep_symbols_compat.patch: drop, since we are no longer
claiming compatibility.
* debian/patches/90_gnutls.patch: Retain symbol versioning compatibility for
non-OpenSSL builds. Closes: #858398.
* Adjust libssl1.1 vs libssl1.0 Suggests/Conflicts; thanks, Adrian Bunk
-- Alessandro Ghedini <ghedo@debian.org> Wed, 23 May 2018 20:25:39 +0100
curl (7.60.0-1) unstable; urgency=medium
* New upstream release (Closes: #891997, #893546, #898856)
+ Fix use of IPv6 literals with NO_PROXY
+ Fix NIL byte out of bounds write due to FTP path trickery
as per CVE-2018-1000120
https://curl.haxx.se/docs/adv_2018-9cd6.html
+ Fix LDAP NULL pointer dereference as per CVE-2018-1000121
https://curl.haxx.se/docs/adv_2018-97a2.html
+ Fix RTSP RTP buffer over-read as per CVE-2018-1000122
https://curl.haxx.se/docs/adv_2018-b047.html
+ Fix heap buffer overflow when closing down an FTP connection
with very long server command replies as per CVE-2018-1000300
https://curl.haxx.se/docs/adv_2018-82c2.html
+ Fix heap buffer over-read when parsing bad RTSP headers
as per CVE-2018-1000301
https://curl.haxx.se/docs/adv_2018-b138.html
* Refresh patches
* Bump Standards-Version to 4.1.4 (no changes needed)
-- Alessandro Ghedini <ghedo@debian.org> Fri, 18 May 2018 20:21:17 +0100
curl (7.58.0-2) unstable; urgency=medium
* Explicitly enable libssh2 support which got silently disabled in the
previous update
-- Alessandro Ghedini <ghedo@debian.org> Wed, 24 Jan 2018 20:27:50 +0000
curl (7.58.0-1) unstable; urgency=medium
* New upstream release
- Fix HTTP/2 trailer out-of-bounds read as per CVE-2018-1000005
https://curl.haxx.se/docs/adv_2018-824a.html
- Fix HTTP authentication leak in redirects as per CVE-2018-1000007
https://curl.haxx.se/docs/adv_2018-b3bf.html
* Point Vcs-* to salsa.d.o
* Bump Standards-Version to 4.1.3 (no changes needed)
* Bump debhlper compat level to 11
* Refresh patches
* fix insecure-copyright-format-uri
-- Alessandro Ghedini <ghedo@debian.org> Wed, 24 Jan 2018 11:13:58 +0000
curl (7.57.0-1) unstable; urgency=medium
* New upstream release
- Fix NTLM buffer overflow via integer overflow as per CVE-2017-8816
https://curl.haxx.se/docs/adv_2017-11e7.html
- Fix FTP wildcard out of bounds read as per CVE-2017-8817
https://curl.haxx.se/docs/adv_2017-ae72.html
- Fix SSL out of buffer access as per CVE-2017-8818
https://curl.haxx.se/docs/adv_2017-af0a.html
* Remove -fdebug-prefix-map from curl-config.
Thanks to Timo Weingärtner for the patch (Closes: #861974, #874223, #874238)
* Don't install zsh completion when cross compiling.
Thanks to Wookey for the patch (Closes: #812965)
-- Alessandro Ghedini <ghedo@debian.org> Thu, 30 Nov 2017 10:16:03 +0000
curl (7.56.1-1) unstable; urgency=medium
* New upstream release
- Fix IMAP FETCH response out of bounds read as per CVE-2017-1000257
https://curl.haxx.se/docs/adv_20171023.html
* Bump Standards-Version to 4.1.1 (no changes needed)
* Drop 01_runtests_gdb.patch
* Drop 12_dont-wait-on-CONNECT.patch
* Refresh patches
* Update *.symbols files
* Use https:// URL in watch file
-- Alessandro Ghedini <ghedo@debian.org> Tue, 24 Oct 2017 11:05:48 +0100
curl (7.55.1-1) unstable; urgency=medium
* New upstream release
- Fix FTBFS on powerpc (Closes: #872502)
* Apply upstream patch to fix connection timeouts with NetworkManager
(Closes: #873181)
* Refresh patches
* Bump Standards-Version to 4.1.0 (no changes needed)
-- Alessandro Ghedini <ghedo@debian.org> Sat, 02 Sep 2017 12:10:22 +0100
curl (7.55.0-1) unstable; urgency=medium
* New upstream release
- Fix TFTP sends more than buffer size as per CVE-2017-1000100
(Closes: #871555)
- Fix URL globbing out of bounds read as per CVE-2017-1000101
(Closes: #871554)
* Refresh patches and drop patches merged upstream
* Update Standards-Version to 4.0.1 (no changes needed)
* Drop -dbg package
-- Alessandro Ghedini <ghedo@debian.org> Sat, 12 Aug 2017 15:18:05 +0100
curl (7.52.1-5) unstable; urgency=high
* Fix TLS session resumption client cert bypass as per CVE-2017-7468
https://curl.haxx.se/docs/adv_20170419.html
-- Alessandro Ghedini <ghedo@debian.org> Wed, 19 Apr 2017 11:19:50 +0100
curl (7.52.1-4) unstable; urgency=medium
* Fix regression in CONNECT response handling (Closes: #857613)
* Fix buffer read overrun on --write-out as per CVE-2017-7407
https://curl.haxx.se/docs/adv_20170403.html (Closes: #859500)
-- Alessandro Ghedini <ghedo@debian.org> Sat, 08 Apr 2017 21:55:27 +0100
curl (7.52.1-3) unstable; urgency=high
* Make SSL_VERIFYSTATUS work again as per CVE-2017-2629
https://curl.haxx.se/docs/adv_20170222.html
-- Alessandro Ghedini <ghedo@debian.org> Tue, 21 Feb 2017 22:38:41 +0000
curl (7.52.1-2) unstable; urgency=medium
* Fix HTTPS connection timeout with OpenSSL (Closes: #852317)
-- Alessandro Ghedini <ghedo@debian.org> Sun, 29 Jan 2017 21:34:10 +0000
curl (7.52.1-1) unstable; urgency=medium
* New upstream release
- Fix printf floating point buffer overflow as per CVE-2016-9586
(Closes: #848958)
* B-D on "libssl1.0-dev | libssl-dev (<< 1.1)" (Closes: #850880, #844018)
* Another attempt at making -dev packages multi-arch.
Thanks to Benjamin Moody for the patches. (Closes: #731998, #846360)
* Enable support for PSL (Closes: #847958)
* Re-enable support for IDN (Closes: #849539)
* Drop 10_disable-network-tests.patch.
It didn't really work, and the issue is not urgent.
* Switch curl binary back to libcurl3/OpenSSL.
While the GnuTLS flavour mostly worked fine, there are a bunch of features
that are not implemented.
-- Alessandro Ghedini <ghedo@debian.org> Thu, 12 Jan 2017 22:02:44 +0000
curl (7.51.0-1) unstable; urgency=medium
* New upstream release
- Fix cookie injection for other servers as per CVE-2016-8615
https://curl.haxx.se/docs/adv_20161102A.html
- Fix case insensitive password comparison as per CVE-2016-8616
https://curl.haxx.se/docs/adv_20161102B.html
- Fix OOB write via unchecked multiplication as per CVE-2016-8617
https://curl.haxx.se/docs/adv_20161102C.html
- Fix double-free in curl_maprintf as per CVE-2016-8618
https://curl.haxx.se/docs/adv_20161102D.html
- Fix double-free in krb5 code as per CVE-2016-8619
https://curl.haxx.se/docs/adv_20161102E.html
- Fix glob parser write/read out of bounds as per CVE-2016-8620
https://curl.haxx.se/docs/adv_20161102F.html
- Fix curl_getdate read out of bounds as per CVE-2016-8621
https://curl.haxx.se/docs/adv_20161102G.html
- Fix URL unescape heap overflow via integer truncation as per CVE-2016-8622
https://curl.haxx.se/docs/adv_20161102H.html
- Fix use-after-free via shared cookies as per CVE-2016-8623
https://curl.haxx.se/docs/adv_20161102I.html
- Fix invalid URL parsing with '#' as per CVE-2016-8624
https://curl.haxx.se/docs/adv_20161102J.html
- Fix IDNA 2003 makes curl use wrong host
https://curl.haxx.se/docs/adv_20161102K.html
- Fix escape and unescape integer overflows as
per CVE-2016-7167 (Closes: #837945)
https://curl.haxx.se/docs/adv_20160914.html
- Fix incorrect reuse of client certificates (NSS backend)
as per CVE-2016-7141 (Closes: #836918)
https://curl.haxx.se/docs/adv_20160907.html
* Drop 02_art_http_scripting.patch (file not shipped anymore)
* Refresh patches
* Temporarily disable IDN support
* Don't install pdf and html docs (they are not shipped in the tarball anymore)
* Install markdown docs
-- Alessandro Ghedini <ghedo@debian.org> Thu, 03 Nov 2016 22:46:14 +0000
curl (7.50.1-2) unstable; urgency=medium
* Disable more network tests (Closes: #830273)
-- Alessandro Ghedini <ghedo@debian.org> Sun, 28 Aug 2016 14:48:05 +0100
curl (7.50.1-1) unstable; urgency=medium
* New upstream release (Closes: #827900)
- Fix TLS session resumption client cert bypass as per CVE-2016-5419
https://curl.haxx.se/docs/adv_20160803A.html
- Fix re-using connection with wrong client cert as per CVE-2016-5420
https://curl.haxx.se/docs/adv_20160803B.html
- Fix use of connection struct after free as per CVE-2016-5421
https://curl.haxx.se/docs/adv_20160803C.html
- Support OpenSSL 1.1 (Closes: #828127)
* Fix 04_workaround_as_needed_bug.patch.
Thanks to Yuriy M. Kaminskiy for the patch (Closes: #818131)
* Bump Standards-Version to 3.9.8 (no changes needed)
* Update Vcs-* URLs
* Refresh patches
* Add 08_enable-zsh.patch to re-enable zsh completion generation
* Remove 08_fix-zsh-completion.patch (was already disabled)
* Add 09_fix-typo.patch to fix spelling-error-in-manpage
* Add 10_disable-network-tests.patch to disable networked tests
(Closes: #830273)
* Improve cross Build-Depends satisfiability.
Thanks to Helmut Grohne for the patch (Closes: #818092)
-- Alessandro Ghedini <ghedo@debian.org> Wed, 03 Aug 2016 12:46:05 +0100
curl (7.47.0-1) unstable; urgency=high
* New upstream release
- Fix NTLM credentials not-checked for proxy connection re-use
as per CVE-2016-0755
http://curl.haxx.se/docs/adv_20160127A.html
- Set uyrgency=high accordingly
* Remove hard-coded dependency on libgnutls (Closes: #812542)
* Drop 08_fix-zsh-completion.patch (merged upstream)
* Refresh patches
-- Alessandro Ghedini <ghedo@debian.org> Wed, 27 Jan 2016 11:45:59 +0000
curl (7.46.0-1) unstable; urgency=medium
* New upstream release
- Initialize OpenSSL algorithms after loading config (Closes: #805408)
* Install curl zsh completion (Closes: #805509)
- Add 08_fix-zsh-completion.patch to fix zsh completion generation
-- Alessandro Ghedini <ghedo@debian.org> Sun, 27 Dec 2015 18:18:09 +0100
curl (7.45.0-1) unstable; urgency=medium
* New upstream release
* Drop 08_spelling.patch (merged upstream)
-- Alessandro Ghedini <ghedo@debian.org> Wed, 07 Oct 2015 12:59:03 +0200
curl (7.44.0-2) unstable; urgency=medium
* Enable HTTP/2 support (Closes: #796302)
-- Alessandro Ghedini <ghedo@debian.org> Thu, 10 Sep 2015 11:25:14 +0200
curl (7.44.0-1) unstable; urgency=medium
* New upstream release
* Refresh patches
* Update symbols files
* Add 08_spelling.patch to fix some spelling errors
-- Alessandro Ghedini <ghedo@debian.org> Wed, 12 Aug 2015 11:49:04 +0200
curl (7.43.0-1) unstable; urgency=medium
* New upstream release
- Fix lingering HTTP credentials in connection re-use as per CVE-2015-3236
http://curl.haxx.se/docs/adv_20150617A.html
- Fix SMB send off unrelated memory contents as per CVE-2015-3237
http://curl.haxx.se/docs/adv_20150617B.html
* Refresh patches
* Fix spelling-error-in-description
-- Alessandro Ghedini <ghedo@debian.org> Wed, 17 Jun 2015 10:21:34 +0200
curl (7.42.1-3) unstable; urgency=medium
* Update copyright
* Set both CA bundle and CA path default values for OpenSSL and GnuTLS
backends
* Bump versioned depends on libgnutls to workaround lack of nettle versioned
symbols (Closes: #787960)
-- Alessandro Ghedini <ghedo@debian.org> Sun, 07 Jun 2015 18:15:15 +0200
curl (7.42.1-2) unstable; urgency=medium
* Switch curl binary to libcurl3-gnutls (Closes: #342719)
This is the first step of a possible migration to a GnuTLS-only
libcurl for Debian. Let's see how it goes.
-- Alessandro Ghedini <ghedo@debian.org> Sun, 03 May 2015 13:13:15 +0200
curl (7.42.1-1) unstable; urgency=high
* New upstream release
- Don't send sensitive HTTP server headers to proxies as per
CVE-2015-3153
http://curl.haxx.se/docs/adv_20150429.html
* Drop 08_fix-spelling.patch (merged upstream)
* Refresh patches
-- Alessandro Ghedini <ghedo@debian.org> Wed, 29 Apr 2015 10:43:43 +0200
curl (7.42.0-1) unstable; urgency=medium
* New upstream release
- Fix re-using authenticated connection when unauthenticated
as per CVE-2015-3143
http://curl.haxx.se/docs/adv_20150422A.html
- Fix host name out of boundary memory access as per CVE-2015-3144
http://curl.haxx.se/docs/adv_20150422D.html
- Fix cookie parser out of boundary memory access as per CVE-2015-3145
http://curl.haxx.se/docs/adv_20150422C.html
- Fix Negotiate not treated as connection-oriented as per CVE-2015-3148
http://curl.haxx.se/docs/adv_20150422B.html
- Disable SSLv3 in the OpenSSL backend when OPENSSL_NO_SSL3_METHOD is
defined (Closes: #768562)
* Drop patches merged upstream
* Refresh patches
* Bump Standards-Version to 3.9.6 (no changes needed)
-- Alessandro Ghedini <ghedo@debian.org> Wed, 22 Apr 2015 11:07:32 +0200
curl (7.38.0-4) unstable; urgency=high
* Fix URL request injection vulnerability as per CVE-2014-8150
http://curl.haxx.se/docs/adv_20150108B.html
* Set urgency=high accordingly
-- Alessandro Ghedini <ghedo@debian.org> Thu, 08 Jan 2015 10:47:24 +0100
curl (7.38.0-3) unstable; urgency=high
* Enable all hardening options (Closes: #763372)
* Fix duphandle read out of bounds as per CVE-2014-3707
http://curl.haxx.se/docs/adv_20141105.html
* Set urgency=high accordingly
-- Alessandro Ghedini <ghedo@debian.org> Thu, 06 Nov 2014 11:40:24 +0100
curl (7.38.0-2) unstable; urgency=medium
* Check for libtoolize instead of libtool during build.
Thanks to Helmut Grohne for the patch (Closes: #761740)
* Add README.source note regarding ordering of patches (Closes: #762193)
* Add 10_fix-resolver.patch from upstream (Closes: #762014)
-- Alessandro Ghedini <ghedo@debian.org> Tue, 23 Sep 2014 16:41:53 +0200
curl (7.38.0-1) unstable; urgency=medium
* New upstream release
- Only use full host matches for hosts used as IP address
as per CVE-2014-3613
http://curl.haxx.se/docs/adv_20140910A.html
- Reject incoming cookies set for TLDs as per CVE-2014-3620
http://curl.haxx.se/docs/adv_20140910B.html
* Drop 08_link-curl-to-nss.patch (merged upstream)
* Refresh patches
* Fix wildcard-matches-nothing-in-dep5-copyright
* Add 08_fix-spelling.patch
-- Alessandro Ghedini <ghedo@debian.org> Wed, 10 Sep 2014 20:11:02 +0200
curl (7.37.1-1) unstable; urgency=medium
* New upstream release
* Re-enable RTMP support (Closes: #754222)
* Add 08_link-curl-to-nss.patch to fix NSS build
* Refresh patches
* Install manpages of single libcurl options too
-- Alessandro Ghedini <ghedo@debian.org> Fri, 18 Jul 2014 10:18:03 +0200
curl (7.37.0-1) unstable; urgency=medium
* New upstream release
- Fix NULL pointer dereference in GnuTLS code (Closes: #746349)
* Drop 08_fix-imap-tests.patch (merged upstream)
* Refresh 01_runtests_gdb.patch
* Remove Build-Depends on libgcrypt
-- Alessandro Ghedini <ghedo@debian.org> Wed, 21 May 2014 15:22:38 +0200