-
Notifications
You must be signed in to change notification settings - Fork 5
/
changelog
2489 lines (1676 loc) · 86.2 KB
/
changelog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
curl (7.68.0-1ubuntu2.5ppa1) focal; urgency=medium
* Support libcurl3 and libcurl4 at the same time.
* Added metapackage curl34.
-- Evgeny Brazgin <xapienz@phystech.edu> Tue, 18 May 2021 11:59:33 -0700
curl (7.68.0-1ubuntu2.5) focal-security; urgency=medium
* SECURITY UPDATE: data leak via referer header field
- debian/patches/CVE-2021-22876.patch: strip credentials from the
auto-referer header field in lib/transfer.c.
- CVE-2021-22876
* SECURITY UPDATE: TLS 1.3 session ticket proxy host mixup
- debian/patches/CVE-2021-22890.patch: make sure we set and extract the
correct session in lib/vtls/*.
- CVE-2021-22890
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Tue, 23 Mar 2021 09:13:04 -0400
curl (7.68.0-1ubuntu2.4) focal-security; urgency=medium
* SECURITY UPDATE: FTP redirect to malicious host via PASV response
- debian/patches/CVE-2020-8284.patch: use CURLOPT_FTP_SKIP_PASV_IP by
default in lib/url.c, src/tool_cfgable.c, docs/*, tests/data/*.
- CVE-2020-8284
* SECURITY UPDATE: FTP wildcard stack buffer overflow in libcurl
- debian/patches/CVE-2020-8285.patch: make wc_statemach loop instead of
recurse in lib/ftp.c.
- CVE-2020-8285
* SECURITY UPDATE: Inferior OCSP verification
- debian/patches/CVE-2020-8286.patch: make the OCSP verification verify
the certificate id in lib/vtls/openssl.c.
- CVE-2020-8286
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Mon, 30 Nov 2020 10:59:13 -0500
curl (7.68.0-1ubuntu2.2) focal-security; urgency=medium
* SECURITY UPDATE: wrong connect-only connection
- debian/patches/CVE-2020-8231.patch: remember last connection by id,
not by pointer in lib/connect.c, lib/easy.c, lib/multi.c, lib/url.c,
lib/urldata.h.
- CVE-2020-8231
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Thu, 13 Aug 2020 13:34:56 -0400
curl (7.68.0-1ubuntu2.1) focal-security; urgency=medium
* SECURITY UPDATE: Partial password leak over DNS on HTTP redirect
- debian/patches/CVE-2020-8169.patch: make the updated credentials
URL-encoded in the URL in lib/url.c, tests/data/test1168,
tests/data/Makefile.inc.
- CVE-2020-8169
* SECURITY UPDATE: curl overwrite local file with -J
- debian/patches/CVE-2020-8177.patch: -i is not OK if -J is used in
src/tool_cb_hdr.c, src/tool_getparam.c.
- CVE-2020-8177
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 17 Jun 2020 09:03:28 -0400
curl (7.68.0-1ubuntu2) focal; urgency=medium
* debian/patches/git_tls13_gnutls.patch:
- Ensure TLS 1.3 works with GnuTLS, thanks Dirkjan Bussink for writting
the patch and pointing it out on launchpad! (lp: #1872698)
-- Sebastien Bacher <seb128@ubuntu.com> Wed, 15 Apr 2020 08:27:03 +0200
curl (7.68.0-1ubuntu1) focal; urgency=low
* Merge from Debian unstable. Remaining changes:
- debian/control, debian/rules: build with libssh instead of libssh2.
-- Steve Langasek <steve.langasek@ubuntu.com> Sun, 23 Feb 2020 12:33:45 -0800
curl (7.68.0-1) unstable; urgency=medium
* New upstream release
* Bump Standards-Version to 4.5.0 (no changes needed)
* Update symbols files
* Configure default CA file with OpenSSL again (Closes: #948441)
-- Alessandro Ghedini <ghedo@debian.org> Sat, 22 Feb 2020 14:37:19 +0000
curl (7.67.0-2ubuntu1) focal; urgency=low
* Merge from Debian unstable. Remaining changes:
- debian/control, debian/rules: build with libssh instead of libssh2.
-- Steve Langasek <steve.langasek@ubuntu.com> Thu, 13 Feb 2020 11:01:54 -0800
curl (7.67.0-2) unstable; urgency=medium
* Restore :native annotation for python3 Build-Depends.
Thanks to Helmut Grohne for the patch (Closes: #945928)
-- Alessandro Ghedini <ghedo@debian.org> Sun, 01 Dec 2019 13:29:28 +0000
curl (7.67.0-1) unstable; urgency=medium
* New upstream release
* Replace python with python3 in Build-Depends (Closes: #942984)
* Bump Standards-Version to 4.4.1 (no changes needed)
-- Alessandro Ghedini <ghedo@debian.org> Sat, 30 Nov 2019 12:45:07 +0000
curl (7.66.0-1ubuntu1) focal; urgency=low
* Merge from Debian unstable. Remaining changes:
- debian/control, debian/rules: build with libssh instead of libssh2.
* Dropped changes, included upstream:
- debian/patches/CVE-2019-5481.patch: update lib/security.c to avoid
double-free on large memory allocation failures
- debian/patches/CVE-2019-5482.patch: ensure to use the correct block
size when calling recvfrom() if the server returns an OACK without
specifying a block size in lib/tftp.c
-- Steve Langasek <steve.langasek@ubuntu.com> Tue, 12 Nov 2019 17:05:51 -0800
curl (7.66.0-1) unstable; urgency=medium
* New upstream release (Closes: #940024)
+ Fix FTP-KRB double-free as per CVE-2019-5481 (Closes: #940009)
https://curl.haxx.se/docs/CVE-2019-5481.html
+ Fix TFTP small blocksize heap buffer overflow as per CVE-2019-5482
(Closes: #940010)
https://curl.haxx.se/docs/CVE-2019-5482.html
* Refresh patches
* Enable brotli support (Closes: #940129)
* Update *.symbols files
-- Alessandro Ghedini <ghedo@debian.org> Sun, 15 Sep 2019 15:47:05 +0100
curl (7.65.3-1ubuntu4) focal; urgency=medium
* No-change rebuild against libnettle7
-- Steve Langasek <steve.langasek@ubuntu.com> Thu, 31 Oct 2019 22:10:02 +0000
curl (7.65.3-1ubuntu3) eoan; urgency=medium
* SECURITY UPDATE: double-free when using kerberos over FTP may cause
denial-of-service
- debian/patches/CVE-2019-5481.patch: update lib/security.c to avoid
double-free on large memory allocation failures
- CVE-2019-5481
* SECURITY UPDATE: heap buffer overflow when receiving TFTP data may
cause denial-of-service or remote code-execution
- debian/patches/CVE-2019-5482.patch: ensure to use the correct block
size when calling recvfrom() if the server returns an OACK without
specifying a block size in lib/tftp.c
- CVE-2019-5482
-- Alex Murray <alex.murray@canonical.com> Fri, 06 Sep 2019 14:52:01 +0930
curl (7.65.3-1ubuntu2) eoan; urgency=medium
* No-change upload with strops.h and sys/strops.h removed in glibc.
-- Matthias Klose <doko@ubuntu.com> Thu, 05 Sep 2019 13:37:38 +0200
curl (7.65.3-1ubuntu1) eoan; urgency=low
* Merge from Debian unstable. Remaining changes:
- debian/control, debian/rules: build with libssh instead of libssh2.
-- Gianfranco Costamagna <locutusofborg@debian.org> Sat, 10 Aug 2019 09:40:03 +0200
curl (7.65.3-1) unstable; urgency=medium
* New upstream release
* Drop 12_fix-man-errors.patch (merged upstream)
* Remove Ian Jackson from Uploaders as he has never done an upload
-- Alessandro Ghedini <ghedo@debian.org> Fri, 09 Aug 2019 19:45:02 +0100
curl (7.65.1-1ubuntu1) eoan; urgency=low
* Merge from Debian unstable. Remaining changes:
- debian/control, debian/rules: build with libssh instead of libssh2.
-- Gianfranco Costamagna <locutusofborg@debian.org> Mon, 15 Jul 2019 15:20:26 +0200
curl (7.65.1-1) unstable; urgency=medium
* New upstream release
+ Reduce verbose output (Closes: #926148)
+ Fix parsing URLs with link local addresses (Closes: #926812)
* Drop patches merged upstream
* Refresh patches
* Bump STandards-Version to 4.4.0 (no changes needed)
* Update entry in copyright for renamed files
* Fix some man errors.
Thanks to Bjarni Ingi Gislason for the patch (Closes: #926352)
* Add Build-Depends-Package field to symbols files
-- Alessandro Ghedini <ghedo@debian.org> Sat, 13 Jul 2019 12:37:09 +0100
curl (7.64.0-4ubuntu1) eoan; urgency=low
* Merge from Debian unstable. Remaining changes:
- debian/control, debian/rules: build with libssh instead of libssh2.
* Dropped changes, included in Debian:
- SECURITY UPDATE: Integer overflows in curl_url_set()
- SECURITY UPDATE: TFTP receive buffer overflow
-- Steve Langasek <steve.langasek@ubuntu.com> Wed, 19 Jun 2019 22:50:09 -0700
curl (7.64.0-4) unstable; urgency=medium
* Fix TFTP receive buffer overflow as per CVE-2019-5436 (Closes: #929351)
https://curl.haxx.se/docs/CVE-2019-5436.html
* Fix integer overflow in curl_url_set() as per CVE-2019-5435 (Closes: #929352)
https://curl.haxx.se/docs/CVE-2019-5435.html
-- Alessandro Ghedini <ghedo@debian.org> Fri, 14 Jun 2019 19:23:32 +0100
curl (7.64.0-3ubuntu2) eoan; urgency=medium
* SECURITY UPDATE: Integer overflows in curl_url_set()
- debian/patches/CVE-2019-5435.patch: limit sizes in lib/setopt.c,
lib/urlapi.c, lib/urldata.h, tests/data/Makefile.inc,
tests/data/test1559, tests/libtest/Makefile.inc,
tests/libtest/lib1559.c.
- CVE-2019-5435
* SECURITY UPDATE: TFTP receive buffer overflow
- debian/patches/CVE-2019-5436.patch: use the current blksize in
lib/tftp.c.
- CVE-2019-5436
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 22 May 2019 09:36:43 -0400
curl (7.64.0-3ubuntu1) eoan; urgency=low
* Merge from Debian unstable. Remaining changes:
* debian/control, debian/rules:
- build with libssh instead of libssh2, that's a better maintained
library and it's in Ubuntu main (lp: #311029)
-- Gianfranco Costamagna <locutusofborg@debian.org> Mon, 13 May 2019 10:02:19 +0200
curl (7.64.0-3) unstable; urgency=medium
* Fix potential crash in HTTP/2 code and busy loop at the end of connections
(Closes: #927471)
-- Alessandro Ghedini <ghedo@debian.org> Sat, 04 May 2019 12:51:06 +0100
curl (7.64.0-2ubuntu1) disco; urgency=low
* Merge from Debian unstable. Remaining changes:
* debian/control, debian/rules:
- build with libssh instead of libssh2, that's a better maintained
library and it's in Ubuntu main (lp: #311029)
-- Gianfranco Costamagna <locutusofborg@debian.org> Fri, 05 Apr 2019 17:50:51 +0200
curl (7.64.0-2) unstable; urgency=medium
* Fix infinite loop when fetching URLs with unreachable IPv6 (Closes: #922554)
-- Alessandro Ghedini <ghedo@debian.org> Thu, 07 Mar 2019 20:02:35 +0000
curl (7.64.0-1ubuntu1) disco; urgency=medium
* Resynchronize with Debian, remaining change
* debian/control, debian/rules:
- build with libssh instead of libssh2, that's a better maintained
library and it's in Ubuntu main (lp: #311029)
-- Sebastien Bacher <seb128@ubuntu.com> Thu, 14 Feb 2019 16:49:23 +0100
curl (7.64.0-1) unstable; urgency=medium
* New upstream release
+ Fix NTLM type-2 out-of-bounds buffer read as per CVE-2018-16890
https://curl.haxx.se/docs/CVE-2018-16890.html
+ Fix NTLMv2 type-3 header stack buffer overflow as per CVE-2019-3822
https://curl.haxx.se/docs/CVE-2019-3822.html
+ Fix SMTP end-of-response out-of-bounds read as per CVE-2019-3823
https://curl.haxx.se/docs/CVE-2019-3823.html
+ Fix HTTP negotiation with POST requests (Closes: #920267)
* Refresh patches
* Import fixes for zsh completion script generator (Closes: #92145)
-- Alessandro Ghedini <ghedo@debian.org> Wed, 06 Feb 2019 22:33:05 +0000
curl (7.63.0-1) unstable; urgency=medium
* New upstream release
+ Fix IPv6 numeral address parser (Closes: #915520)
+ Fix timeout handling (Closes: #914793)
+ Fix HTTP auth to include query in URI (Closes: #913214)
* Drop 12_fix-runtests-curl.patch (merged upstream)
* Update symbols
* Update copyright for removed files
* Bump debhlper compat level to 12
* Bump Standards-Version to 4.3.0 (no changes needed)
-- Alessandro Ghedini <ghedo@debian.org> Tue, 15 Jan 2019 20:47:40 +0000
curl (7.62.0-1) unstable; urgency=medium
* New upstream release
+ Fix NTLM password overflow via integer overflow as per CVE-2018-14618
(Closes: #908327) https://curl.haxx.se/docs/CVE-2018-14618.html
+ Fix SASL password overflow via integer overflow as per CVE-2018-16839
https://curl.haxx.se/docs/CVE-2018-16839.html
+ Fix use-after-free in handle close as per CVE-2018-16840
https://curl.haxx.se/docs/CVE-2018-16840.html
+ Fix warning message out-of-buffer read as per CVE-2018-16842
https://curl.haxx.se/docs/CVE-2018-16842.html
+ Fix broken terminal output (closes: #911333)
* Refresh patches
* Add 12_fix-runtests-curl.patch to fix running curl in tests
-- Alessandro Ghedini <ghedo@debian.org> Wed, 31 Oct 2018 22:42:44 +0000
curl (7.61.0-1) unstable; urgency=medium
* New upstream release
+ Fix SMTP send heap buffer overflow as per CVE-2018-0500 (Closes: #903546)
https://curl.haxx.se/docs/adv_2018-70a2.html
+ Fix some crashes related to HTTP/2 (Closes: #902628)
* Disable libssh2 on Ubuntu.
Thanks to Gianfranco Costamagna for the patch (Closes: #888449)
* Bump Standards-Version to 4.2.0 (no changes needed)
* Don't configure default CA bundle with OpenSSL and GnuTLS (Closes: #883174)
-- Alessandro Ghedini <ghedo@debian.org> Sat, 11 Aug 2018 13:32:28 +0100
curl (7.60.0-2) unstable; urgency=medium
[ Steve Langasek ]
* Build-depend on libssl-dev instead of libssl1.0-dev.
* Rename libcurl3 to libcurl4, because libcurl exposes an SSL_CTX via
CURLOPT_SSL_CTX_FUNCTION, and this object changes incompatibly between
openssl 1.0 and openssl 1.1.
* debian/patches/03_keep_symbols_compat.patch: drop, since we are no longer
claiming compatibility.
* debian/patches/90_gnutls.patch: Retain symbol versioning compatibility for
non-OpenSSL builds. Closes: #858398.
* Adjust libssl1.1 vs libssl1.0 Suggests/Conflicts; thanks, Adrian Bunk
-- Alessandro Ghedini <ghedo@debian.org> Wed, 23 May 2018 20:25:39 +0100
curl (7.60.0-1) unstable; urgency=medium
* New upstream release (Closes: #891997, #893546, #898856)
+ Fix use of IPv6 literals with NO_PROXY
+ Fix NIL byte out of bounds write due to FTP path trickery
as per CVE-2018-1000120
https://curl.haxx.se/docs/adv_2018-9cd6.html
+ Fix LDAP NULL pointer dereference as per CVE-2018-1000121
https://curl.haxx.se/docs/adv_2018-97a2.html
+ Fix RTSP RTP buffer over-read as per CVE-2018-1000122
https://curl.haxx.se/docs/adv_2018-b047.html
+ Fix heap buffer overflow when closing down an FTP connection
with very long server command replies as per CVE-2018-1000300
https://curl.haxx.se/docs/adv_2018-82c2.html
+ Fix heap buffer over-read when parsing bad RTSP headers
as per CVE-2018-1000301
https://curl.haxx.se/docs/adv_2018-b138.html
* Refresh patches
* Bump Standards-Version to 4.1.4 (no changes needed)
-- Alessandro Ghedini <ghedo@debian.org> Fri, 18 May 2018 20:21:17 +0100
curl (7.58.0-2) unstable; urgency=medium
* Explicitly enable libssh2 support which got silently disabled in the
previous update
-- Alessandro Ghedini <ghedo@debian.org> Wed, 24 Jan 2018 20:27:50 +0000
curl (7.58.0-1) unstable; urgency=medium
* New upstream release
- Fix HTTP/2 trailer out-of-bounds read as per CVE-2018-1000005
https://curl.haxx.se/docs/adv_2018-824a.html
- Fix HTTP authentication leak in redirects as per CVE-2018-1000007
https://curl.haxx.se/docs/adv_2018-b3bf.html
* Point Vcs-* to salsa.d.o
* Bump Standards-Version to 4.1.3 (no changes needed)
* Bump debhlper compat level to 11
* Refresh patches
* fix insecure-copyright-format-uri
-- Alessandro Ghedini <ghedo@debian.org> Wed, 24 Jan 2018 11:13:58 +0000
curl (7.57.0-1) unstable; urgency=medium
* New upstream release
- Fix NTLM buffer overflow via integer overflow as per CVE-2017-8816
https://curl.haxx.se/docs/adv_2017-11e7.html
- Fix FTP wildcard out of bounds read as per CVE-2017-8817
https://curl.haxx.se/docs/adv_2017-ae72.html
- Fix SSL out of buffer access as per CVE-2017-8818
https://curl.haxx.se/docs/adv_2017-af0a.html
* Remove -fdebug-prefix-map from curl-config.
Thanks to Timo Weingärtner for the patch (Closes: #861974, #874223, #874238)
* Don't install zsh completion when cross compiling.
Thanks to Wookey for the patch (Closes: #812965)
-- Alessandro Ghedini <ghedo@debian.org> Thu, 30 Nov 2017 10:16:03 +0000
curl (7.56.1-1) unstable; urgency=medium
* New upstream release
- Fix IMAP FETCH response out of bounds read as per CVE-2017-1000257
https://curl.haxx.se/docs/adv_20171023.html
* Bump Standards-Version to 4.1.1 (no changes needed)
* Drop 01_runtests_gdb.patch
* Drop 12_dont-wait-on-CONNECT.patch
* Refresh patches
* Update *.symbols files
* Use https:// URL in watch file
-- Alessandro Ghedini <ghedo@debian.org> Tue, 24 Oct 2017 11:05:48 +0100
curl (7.55.1-1) unstable; urgency=medium
* New upstream release
- Fix FTBFS on powerpc (Closes: #872502)
* Apply upstream patch to fix connection timeouts with NetworkManager
(Closes: #873181)
* Refresh patches
* Bump Standards-Version to 4.1.0 (no changes needed)
-- Alessandro Ghedini <ghedo@debian.org> Sat, 02 Sep 2017 12:10:22 +0100
curl (7.55.0-1) unstable; urgency=medium
* New upstream release
- Fix TFTP sends more than buffer size as per CVE-2017-1000100
(Closes: #871555)
- Fix URL globbing out of bounds read as per CVE-2017-1000101
(Closes: #871554)
* Refresh patches and drop patches merged upstream
* Update Standards-Version to 4.0.1 (no changes needed)
* Drop -dbg package
-- Alessandro Ghedini <ghedo@debian.org> Sat, 12 Aug 2017 15:18:05 +0100
curl (7.52.1-5) unstable; urgency=high
* Fix TLS session resumption client cert bypass as per CVE-2017-7468
https://curl.haxx.se/docs/adv_20170419.html
-- Alessandro Ghedini <ghedo@debian.org> Wed, 19 Apr 2017 11:19:50 +0100
curl (7.52.1-4) unstable; urgency=medium
* Fix regression in CONNECT response handling (Closes: #857613)
* Fix buffer read overrun on --write-out as per CVE-2017-7407
https://curl.haxx.se/docs/adv_20170403.html (Closes: #859500)
-- Alessandro Ghedini <ghedo@debian.org> Sat, 08 Apr 2017 21:55:27 +0100
curl (7.52.1-3) unstable; urgency=high
* Make SSL_VERIFYSTATUS work again as per CVE-2017-2629
https://curl.haxx.se/docs/adv_20170222.html
-- Alessandro Ghedini <ghedo@debian.org> Tue, 21 Feb 2017 22:38:41 +0000
curl (7.52.1-2) unstable; urgency=medium
* Fix HTTPS connection timeout with OpenSSL (Closes: #852317)
-- Alessandro Ghedini <ghedo@debian.org> Sun, 29 Jan 2017 21:34:10 +0000
curl (7.52.1-1) unstable; urgency=medium
* New upstream release
- Fix printf floating point buffer overflow as per CVE-2016-9586
(Closes: #848958)
* B-D on "libssl1.0-dev | libssl-dev (<< 1.1)" (Closes: #850880, #844018)
* Another attempt at making -dev packages multi-arch.
Thanks to Benjamin Moody for the patches. (Closes: #731998, #846360)
* Enable support for PSL (Closes: #847958)
* Re-enable support for IDN (Closes: #849539)
* Drop 10_disable-network-tests.patch.
It didn't really work, and the issue is not urgent.
* Switch curl binary back to libcurl3/OpenSSL.
While the GnuTLS flavour mostly worked fine, there are a bunch of features
that are not implemented.
-- Alessandro Ghedini <ghedo@debian.org> Thu, 12 Jan 2017 22:02:44 +0000
curl (7.51.0-1) unstable; urgency=medium
* New upstream release
- Fix cookie injection for other servers as per CVE-2016-8615
https://curl.haxx.se/docs/adv_20161102A.html
- Fix case insensitive password comparison as per CVE-2016-8616
https://curl.haxx.se/docs/adv_20161102B.html
- Fix OOB write via unchecked multiplication as per CVE-2016-8617
https://curl.haxx.se/docs/adv_20161102C.html
- Fix double-free in curl_maprintf as per CVE-2016-8618
https://curl.haxx.se/docs/adv_20161102D.html
- Fix double-free in krb5 code as per CVE-2016-8619
https://curl.haxx.se/docs/adv_20161102E.html
- Fix glob parser write/read out of bounds as per CVE-2016-8620
https://curl.haxx.se/docs/adv_20161102F.html
- Fix curl_getdate read out of bounds as per CVE-2016-8621
https://curl.haxx.se/docs/adv_20161102G.html
- Fix URL unescape heap overflow via integer truncation as per CVE-2016-8622
https://curl.haxx.se/docs/adv_20161102H.html
- Fix use-after-free via shared cookies as per CVE-2016-8623
https://curl.haxx.se/docs/adv_20161102I.html
- Fix invalid URL parsing with '#' as per CVE-2016-8624
https://curl.haxx.se/docs/adv_20161102J.html
- Fix IDNA 2003 makes curl use wrong host
https://curl.haxx.se/docs/adv_20161102K.html
- Fix escape and unescape integer overflows as
per CVE-2016-7167 (Closes: #837945)
https://curl.haxx.se/docs/adv_20160914.html
- Fix incorrect reuse of client certificates (NSS backend)
as per CVE-2016-7141 (Closes: #836918)
https://curl.haxx.se/docs/adv_20160907.html
* Drop 02_art_http_scripting.patch (file not shipped anymore)
* Refresh patches
* Temporarily disable IDN support
* Don't install pdf and html docs (they are not shipped in the tarball anymore)
* Install markdown docs
-- Alessandro Ghedini <ghedo@debian.org> Thu, 03 Nov 2016 22:46:14 +0000
curl (7.50.1-2) unstable; urgency=medium
* Disable more network tests (Closes: #830273)
-- Alessandro Ghedini <ghedo@debian.org> Sun, 28 Aug 2016 14:48:05 +0100
curl (7.50.1-1) unstable; urgency=medium
* New upstream release (Closes: #827900)
- Fix TLS session resumption client cert bypass as per CVE-2016-5419
https://curl.haxx.se/docs/adv_20160803A.html
- Fix re-using connection with wrong client cert as per CVE-2016-5420
https://curl.haxx.se/docs/adv_20160803B.html
- Fix use of connection struct after free as per CVE-2016-5421
https://curl.haxx.se/docs/adv_20160803C.html
- Support OpenSSL 1.1 (Closes: #828127)
* Fix 04_workaround_as_needed_bug.patch.
Thanks to Yuriy M. Kaminskiy for the patch (Closes: #818131)
* Bump Standards-Version to 3.9.8 (no changes needed)
* Update Vcs-* URLs
* Refresh patches
* Add 08_enable-zsh.patch to re-enable zsh completion generation
* Remove 08_fix-zsh-completion.patch (was already disabled)
* Add 09_fix-typo.patch to fix spelling-error-in-manpage
* Add 10_disable-network-tests.patch to disable networked tests
(Closes: #830273)
* Improve cross Build-Depends satisfiability.
Thanks to Helmut Grohne for the patch (Closes: #818092)
-- Alessandro Ghedini <ghedo@debian.org> Wed, 03 Aug 2016 12:46:05 +0100
curl (7.47.0-1) unstable; urgency=high
* New upstream release
- Fix NTLM credentials not-checked for proxy connection re-use
as per CVE-2016-0755
http://curl.haxx.se/docs/adv_20160127A.html
- Set uyrgency=high accordingly
* Remove hard-coded dependency on libgnutls (Closes: #812542)
* Drop 08_fix-zsh-completion.patch (merged upstream)
* Refresh patches
-- Alessandro Ghedini <ghedo@debian.org> Wed, 27 Jan 2016 11:45:59 +0000
curl (7.46.0-1) unstable; urgency=medium
* New upstream release
- Initialize OpenSSL algorithms after loading config (Closes: #805408)
* Install curl zsh completion (Closes: #805509)
- Add 08_fix-zsh-completion.patch to fix zsh completion generation
-- Alessandro Ghedini <ghedo@debian.org> Sun, 27 Dec 2015 18:18:09 +0100
curl (7.45.0-1) unstable; urgency=medium
* New upstream release
* Drop 08_spelling.patch (merged upstream)
-- Alessandro Ghedini <ghedo@debian.org> Wed, 07 Oct 2015 12:59:03 +0200
curl (7.44.0-2) unstable; urgency=medium
* Enable HTTP/2 support (Closes: #796302)
-- Alessandro Ghedini <ghedo@debian.org> Thu, 10 Sep 2015 11:25:14 +0200
curl (7.44.0-1) unstable; urgency=medium
* New upstream release
* Refresh patches
* Update symbols files
* Add 08_spelling.patch to fix some spelling errors
-- Alessandro Ghedini <ghedo@debian.org> Wed, 12 Aug 2015 11:49:04 +0200
curl (7.43.0-1) unstable; urgency=medium
* New upstream release
- Fix lingering HTTP credentials in connection re-use as per CVE-2015-3236
http://curl.haxx.se/docs/adv_20150617A.html
- Fix SMB send off unrelated memory contents as per CVE-2015-3237
http://curl.haxx.se/docs/adv_20150617B.html
* Refresh patches
* Fix spelling-error-in-description
-- Alessandro Ghedini <ghedo@debian.org> Wed, 17 Jun 2015 10:21:34 +0200
curl (7.42.1-3) unstable; urgency=medium
* Update copyright
* Set both CA bundle and CA path default values for OpenSSL and GnuTLS
backends
* Bump versioned depends on libgnutls to workaround lack of nettle versioned
symbols (Closes: #787960)
-- Alessandro Ghedini <ghedo@debian.org> Sun, 07 Jun 2015 18:15:15 +0200
curl (7.42.1-2) unstable; urgency=medium
* Switch curl binary to libcurl3-gnutls (Closes: #342719)
This is the first step of a possible migration to a GnuTLS-only
libcurl for Debian. Let's see how it goes.
-- Alessandro Ghedini <ghedo@debian.org> Sun, 03 May 2015 13:13:15 +0200
curl (7.42.1-1) unstable; urgency=high
* New upstream release
- Don't send sensitive HTTP server headers to proxies as per
CVE-2015-3153
http://curl.haxx.se/docs/adv_20150429.html
* Drop 08_fix-spelling.patch (merged upstream)
* Refresh patches
-- Alessandro Ghedini <ghedo@debian.org> Wed, 29 Apr 2015 10:43:43 +0200
curl (7.42.0-1) unstable; urgency=medium
* New upstream release
- Fix re-using authenticated connection when unauthenticated
as per CVE-2015-3143
http://curl.haxx.se/docs/adv_20150422A.html
- Fix host name out of boundary memory access as per CVE-2015-3144
http://curl.haxx.se/docs/adv_20150422D.html
- Fix cookie parser out of boundary memory access as per CVE-2015-3145
http://curl.haxx.se/docs/adv_20150422C.html
- Fix Negotiate not treated as connection-oriented as per CVE-2015-3148
http://curl.haxx.se/docs/adv_20150422B.html
- Disable SSLv3 in the OpenSSL backend when OPENSSL_NO_SSL3_METHOD is
defined (Closes: #768562)
* Drop patches merged upstream
* Refresh patches
* Bump Standards-Version to 3.9.6 (no changes needed)
-- Alessandro Ghedini <ghedo@debian.org> Wed, 22 Apr 2015 11:07:32 +0200
curl (7.38.0-4) unstable; urgency=high
* Fix URL request injection vulnerability as per CVE-2014-8150
http://curl.haxx.se/docs/adv_20150108B.html
* Set urgency=high accordingly
-- Alessandro Ghedini <ghedo@debian.org> Thu, 08 Jan 2015 10:47:24 +0100
curl (7.38.0-3) unstable; urgency=high
* Enable all hardening options (Closes: #763372)
* Fix duphandle read out of bounds as per CVE-2014-3707
http://curl.haxx.se/docs/adv_20141105.html
* Set urgency=high accordingly
-- Alessandro Ghedini <ghedo@debian.org> Thu, 06 Nov 2014 11:40:24 +0100
curl (7.38.0-2) unstable; urgency=medium
* Check for libtoolize instead of libtool during build.
Thanks to Helmut Grohne for the patch (Closes: #761740)
* Add README.source note regarding ordering of patches (Closes: #762193)
* Add 10_fix-resolver.patch from upstream (Closes: #762014)
-- Alessandro Ghedini <ghedo@debian.org> Tue, 23 Sep 2014 16:41:53 +0200
curl (7.38.0-1) unstable; urgency=medium
* New upstream release
- Only use full host matches for hosts used as IP address
as per CVE-2014-3613
http://curl.haxx.se/docs/adv_20140910A.html
- Reject incoming cookies set for TLDs as per CVE-2014-3620
http://curl.haxx.se/docs/adv_20140910B.html
* Drop 08_link-curl-to-nss.patch (merged upstream)
* Refresh patches
* Fix wildcard-matches-nothing-in-dep5-copyright
* Add 08_fix-spelling.patch
-- Alessandro Ghedini <ghedo@debian.org> Wed, 10 Sep 2014 20:11:02 +0200
curl (7.37.1-1) unstable; urgency=medium
* New upstream release
* Re-enable RTMP support (Closes: #754222)
* Add 08_link-curl-to-nss.patch to fix NSS build
* Refresh patches
* Install manpages of single libcurl options too
-- Alessandro Ghedini <ghedo@debian.org> Fri, 18 Jul 2014 10:18:03 +0200
curl (7.37.0-1) unstable; urgency=medium
* New upstream release
- Fix NULL pointer dereference in GnuTLS code (Closes: #746349)
* Drop 08_fix-imap-tests.patch (merged upstream)
* Refresh 01_runtests_gdb.patch
* Remove Build-Depends on libgcrypt
-- Alessandro Ghedini <ghedo@debian.org> Wed, 21 May 2014 15:22:38 +0200
curl (7.36.0-2) unstable; urgency=medium
* Move Depends on -dev packages needed to use static libraries to Suggests
* Switch to GnuTLS 3.x (Closes: #741568)
* Disable RTMP support (librtmp-dev requires libgnutls-dev, which conflicts
with libgnutls28-dev)
-- Alessandro Ghedini <ghedo@debian.org> Mon, 28 Apr 2014 19:37:14 +0200
curl (7.36.0-1) unstable; urgency=high
* New upstream release (Closes: #742728)
- Fix connection re-use when using different log-in credentials
as per CVE-2014-0138
http://curl.haxx.se/docs/adv_20140326A.html
- Reject IP address wildcard matches as per CVE-2014-0139
http://curl.haxx.se/docs/adv_20140326B.html
- Set urgency=high accordingly
* Add 08_fix-imap-tests.patch to fix tests broken by the fix for CVE-2014-0138
-- Alessandro Ghedini <ghedo@debian.org> Sun, 30 Mar 2014 15:36:35 +0200
curl (7.35.0-1) unstable; urgency=high
* New upstream release
- Fix re-use of wrong HTTP NTLM connection as per CVE-2014-0015
http://curl.haxx.se/docs/adv_20140129.html
- Set urgency=high accordingly
* Refresh patches
-- Alessandro Ghedini <ghedo@debian.org> Wed, 29 Jan 2014 11:16:57 +0100
curl (7.34.0-1) unstable; urgency=high
* New upstream release
- Fix GnuTLS checking of a certificate CN or SAN name field when the
digital signature verification is turned off as per CVE-2013-6422
http://curl.haxx.se/docs/adv_20131217.html
- Set urgency=high accordingly
* Drop patches merged upstream:
- 08_fix-typo.patch
- 09_fix-urlglob.patch
-- Alessandro Ghedini <ghedo@debian.org> Tue, 17 Dec 2013 13:16:19 +0100
curl (7.33.0-2) unstable; urgency=low
* Make -dev packages Multi-Arch: same too (Closes: #731309)
* Bump Standards-Version to 3.9.5 (no changes needed)
* Add 09_fix-urlglob.patch to fix URL globbing (Closes: #731855)
-- Alessandro Ghedini <ghedo@debian.org> Wed, 11 Dec 2013 18:44:37 +0100
curl (7.33.0-1) unstable; urgency=low
* New upstream release
- Handle arbitrary-length username and password (Closes: #719856)
* Remove Luk from Uploaders as per his request (Closes: #723603)
* Do not Build-Depends on specific automake version (Closes: #724361)
* Fix lintian vcs-field-not-canonical
* Add 08_fix-typo.patch
* Refresh patches
-- Alessandro Ghedini <ghedo@debian.org> Mon, 14 Oct 2013 22:11:14 +0200
curl (7.32.0-1) unstable; urgency=low
* New upstream release
* Fix typo in changelog entry for 7.31.0-1 (Closes: #714502)
* Drop 08_typo.patch (merged upstream)
* Drop 09_openssl-recv.patch (merged upstream)
* Refresh 90_gnutls.patch and 99_nss.patch
* Refresh 06_always-disable-valgrind.patch
* Enable threaded DNS resolver (Closes: #570436)
See NEWS.Debian for more info
-- Alessandro Ghedini <ghedo@debian.org> Mon, 12 Aug 2013 12:19:05 +0200
curl (7.31.0-2) unstable; urgency=high
* Add 09_openssl-recv.patch to fix incorrect OpenSSL usage (Closes: #714050)
* Set urgency=high because of the security fix in the previous upload
-- Alessandro Ghedini <ghedo@debian.org> Wed, 26 Jun 2013 11:47:00 +0200
curl (7.31.0-1) unstable; urgency=low
* New upstream release
- Fix URL decode buffer boundary flaw as per CVE-2013-2174
http://curl.haxx.se/docs/adv_20130622.html
* Make curl Multi-Arch: foreign (Closes: #712585)
* Drop 08_reset-timecond.patch (merged upstream)
* Refresh patches
* Add 08_typo.patch to fix a couple of typos in one of the manpages
-- Alessandro Ghedini <ghedo@debian.org> Sat, 22 Jun 2013 15:46:53 +0200
curl (7.30.0-2) unstable; urgency=low
* Move textual docs to the -doc package too
* Move manpages from -dev packages to -doc as well
- Add Breaks+Replaces accordingly
* Remove outdated Replaces/Conflicts
* Update watch file version to 3
* Add 08_reset-timecond.patch (Closes: #705783)
-- Alessandro Ghedini <ghedo@debian.org> Fri, 10 May 2013 17:46:46 +0200
curl (7.30.0-1) unstable; urgency=low
* New upstream release
* Update upstream copyright years
* Drop patches merged upstream:
- 08_NULL-pointer-dereference-on-close.patch
- 09_CVE-213-1944.patch
- 10_test1218-another-cookie-tailmatch-test.patch
* Update patches:
- 03_keep_symbols_compat.patch
- 90_gnutls.patch
- 99_nss.patch
* Add libcurl4-doc package:
- Move *.pdf and *.html files to the libcurl4-doc package
- Add Suggests for -doc package to -dev packages
- Move examples to the -doc package
* Add Build-Depends on python which is used by some tests
-- Alessandro Ghedini <ghedo@debian.org> Thu, 18 Apr 2013 12:55:09 +0200
curl (7.29.0-2.1) unstable; urgency=high
* Non-maintainer upload.
[ Alessandro Ghedini ]
* Do not compress *.pdf files (Closes: #704093)
[ Salvatore Bonaccorso ]
* Add 09_CVE-213-1944.patch.
Fix CVE-2013-1944: fix tailmatching to prevent cross-domain leakage.
Cookies set for 'example.com' could accidentaly also be sent by libcurl
to the 'bexample.com' (ie with a prefix to the first domain name).
(Closes: #705274)
* Add testcase for CVE-2013-1944.
-- Salvatore Bonaccorso <carnil@debian.org> Fri, 12 Apr 2013 13:55:34 +0200
curl (7.29.0-2) unstable; urgency=low
* Fix a segfault when closing an unused multi handle (Closes: #701713)
* Mention LDAPS in packages' long descriptions
* Clean-up d/rules
- Switch to short-form dh
- Enable test suite on hurd and kfreebsd too
- Enable GSSAPI support on hurd too
-- Alessandro Ghedini <ghedo@debian.org> Mon, 11 Mar 2013 19:02:56 +0100
curl (7.29.0-1) unstable; urgency=high
* New upstream release
- Fix buffer overflow when negotiating SASL DIGEST-MD5 authentication
as per CVE-2013-0249 (Closes: #700002)
http://curl.haxx.se/docs/adv_20130206.html
- Set urgency=high accordingly
* Install all the examples
* Update 90_gnutls.patch and 99_nss.patch
* Refresh patches
* Correctly pass CPPFLAGS to ./configure
* Upload to unstable
-- Alessandro Ghedini <ghedo@debian.org> Mon, 11 Feb 2013 14:48:03 +0100
curl (7.28.1-1) experimental; urgency=low
* New upstream release
* Drop 05_fix-git-over-https.patch and 08_fix-git-auth.patch
(merged upstream)
* Update 07_do-not-disable-debug-symbols.patch
* Refresh patches
* Add NEWS entry about change in CURLOPT_SSL_VERIFYHOST semantics
-- Alessandro Ghedini <ghedo@debian.org> Mon, 26 Nov 2012 17:51:27 +0100
curl (7.28.0-3) unstable; urgency=low
* Add 07_do-not-disable-debug-symbols.patch, do not pass --enable-debug
anymore (Closes: #693110)
* Update 05_fix-git-over-https.patch to reflect new upstream patch
* Add 08_fix-git-auth.patch to fix HTTPS authentication (Closes: #690764)
-- Alessandro Ghedini <ghedo@debian.org> Sat, 17 Nov 2012 14:07:21 +0100
curl (7.28.0-2) unstable; urgency=low
* Add 05_fix-git-over-https.patch (Closes: #690551)
* Add 06_always-disable-valgrind.patch (Closes: #690968)
-- Alessandro Ghedini <ghedo@debian.org> Mon, 22 Oct 2012 14:35:02 +0200
curl (7.28.0-1) unstable; urgency=low
* New upstream release
- gnutls: do not fail on non-fatal handshake errors (Closes: #685402)
* Remove versioned build depends on libssh2 (already in stable)
* Bump Standards-Version to 3.9.4 (no changes needed)
* Refresh 01_runtests_gdb.patch
* Update *.symbols files
* Build depend on ca-certifcates to avoid test failure
-- Alessandro Ghedini <ghedo@debian.org> Thu, 11 Oct 2012 19:11:09 +0200
curl (7.27.0-1) unstable; urgency=low
* New upstream release
* Update upstream copyright
* Refresh 01_runtests_gdb.patch, 90_gnutls.patch and 99_nss.patch
-- Alessandro Ghedini <ghedo@debian.org> Wed, 08 Aug 2012 17:22:00 +0200
curl (7.26.0-1) unstable; urgency=low
* New upstream release
- Reject numerical IPv6 addresses outside brackets (Closes: #670126)
* Email change: Alessandro Ghedini -> ghedo@debian.org
* Stricter Depends on libcurl3 (Closes: #666089)
* Remove Ramakrishnan (as per his request), move myself to Maintainer
Thank you for all your work so far
* Disable memory tracking, but keep debug enabled
- Remove memdebug symbols (used by curl only)
* Refresh 01_runtests_gdb.patch, 90_gnutls.patch and 99_nss.patch
* Disable not-quite-working symbols hiding
-- Alessandro Ghedini <ghedo@debian.org> Fri, 25 May 2012 15:19:51 +0200
curl (7.25.0-1) unstable; urgency=low
* New upstream release
- Add --ssl-allow-beast and CURLOPT_SSL_OPTIONS (Closes: #658276)
- Allow negative numbers as option value (Closes: #659591)
* Add libssh2-1-dev to libcurl4-gnutls-dev and libcurl4-nss-dev Depends
* Bump debhelper compat level to 9
- Make *.links files executable to simplify rules file
* Pass --as-needed ld flag to avoid unneeded dependencies
- Add workaround_as_needed_bug to workaround a libtool bug
- Drop dont_link_to_krb5 (not needed because of --as-needed)
* Do some clean-up in debian/rules
* Update debian/copyright format as in Debian Policy 3.9.3
* Bump Standards-Version to 3.9.3
* Explicit Conflicts in -dev packages (fixes binaries-have-file-conflict)
* Add openssh-server to build depends to enable some more tests
* Update upstream copyright years
* Refresh patches
-- Alessandro Ghedini <al3xbio@gmail.com> Fri, 23 Mar 2012 16:24:51 +0100
curl (7.24.0-1) unstable; urgency=high
* New upstream release
- Improve documentation for the --capath option (Closes: #628697)
- Fix URL sanitization vulnerability as per CVE-2012-0036
http://curl.haxx.se/docs/adv_20120124.html
- Fix SSL CBC IV vulnerability as per CVE-2011-3389
http://curl.haxx.se/docs/adv_20120124B.html
- Set urgency=high accordingly
* Remove curl_links_with_rt patch (curl links to librt anyway)
* Improve descriptions of -dev and -dbg packages
* Drop fix_manpage_spelling and versioned patches (merged upstream)
* Refresh patches
* Add keep_symbols_compat patch to not break backwards ABI compatibility
* Enable libssh2 support for GnuTLS and NSS flavours too
(libssh2 now uses libgcrypt instead of libssl)
-- Alessandro Ghedini <al3xbio@gmail.com> Tue, 24 Jan 2012 12:04:04 +0100