~ubuntu-branches/ubuntu/lucid/curl/lucid-security

From Revision 51 to 32

expand all

collapse all

Rev		Summary	Authors	Tags	Date	Diff	Files
51		* SECURITY UPDATE: URL request injection * SECURITY UPDATE: URL request injection   - debian/patches/CVE-2014-8150.patch: drop bad chars from URL in     lib/url.c.   - CVE-2014-8150	Marc Deslauriers	7.19.7-1ubuntu1.11	9 years ago
50		* SECURITY UPDATE: sensitive data disclosure via duphandle r... * SECURITY UPDATE: sensitive data disclosure via duphandle read out of   bounds   - debian/patches/CVE-2014-3707.patch: properly copy memory aread in     lib/formdata.c, lib/strdup.{c,h}, lib/url.c, lib/urldata.h,     src/Makefile.inc.   - CVE-2014-3707	Marc Deslauriers	7.19.7-1ubuntu1.10	9 years ago
49		* SECURITY UPDATE: incorrect cookie handling via partial lit... * SECURITY UPDATE: incorrect cookie handling via partial literal IP   addresses   - debian/patches/CVE-2014-3613.patch: only use full host matches for     hosts used as IP address in lib/cookie.c, added tests to     tests/data/test1105, tests/data/test31, tests/data/test8.   - CVE-2014-3613 * debian/patches/disable_test519.path: disable test 519 as previous   security update causes it to hang. * debian/patches/versioned: added Curl_* so test suite works during   build.	Marc Deslauriers	7.19.7-1ubuntu1.9	9 years ago
48		* SECURITY UPDATE: wrong re-use of connections * SECURITY UPDATE: wrong re-use of connections   - debian/patches/CVE-2014-0138.patch: fix possible issues with NTLM     HTTP logic, and extend new connection logic to other protocols in     lib/http.c, lib/url.c, lib/urldata.h, add new tests to     tests/data/Makefile.am, tests/data/test1418, tests/data/test1419.   - CVE-2014-0138 * SECURITY UPDATE: incorrect wildcard SSL certificate validation with   literal IP addresses   - debian/patches/CVE-2014-0139.patch: fix wildcard logic in     lib/ssluse.c.   - CVE-2014-0139 * debian/patches/fix_test172.path: fix expired cookie causing test to   fail. * debian/patches/disable_test519.path: disable test 519 as security   update causes it to hang. Fixing this would require backporting new   logic into tests/server/sws.c.	Marc Deslauriers	7.19.7-1ubuntu1.7	10 years ago
47		* SECURITY UPDATE: information disclosure via incorrect NTLM... * SECURITY UPDATE: information disclosure via incorrect NTLM credential   reuse   - debian/patches/CVE-2014-0015.patch: don't reuse connections if NTLM     auth is used in lib/url.c.   - CVE-2014-0015	Marc Deslauriers	7.19.7-1ubuntu1.6	10 years ago
46		* SECURITY REGRESSION: can't disable cert checking in comman... * SECURITY REGRESSION: can't disable cert checking in command line tool   (LP: #1258366)   - debian/patches/CVE-2013-4545.patch: properly disable host     verification when insecure mode is used in src/main.c.   - CVE-2013-4545	Marc Deslauriers	7.19.7-1ubuntu1.5	10 years ago
45		* SECURITY UPDATE: missing CN verification when signature ve... * SECURITY UPDATE: missing CN verification when signature verification is   disabled.   - debian/patches/CVE-2013-4545.patch: still verify host when     CURLOPT_SSL_VERIFYPEER isn't set in lib/ssluse.c.   - CVE-2013-4545	Marc Deslauriers	7.19.7-1ubuntu1.4	10 years ago
44		* SECURITY UPDATE: denial of service and possible code execu... * SECURITY UPDATE: denial of service and possible code execution via   heap overflow in URL decoder   - debian/patches/CVE-2013-2174.patch: fix overflow in lib/escape.c.   - CVE-2013-2174	Marc Deslauriers	7.19.7-1ubuntu1.3	10 years ago
43		* SECURITY UPDATE: Incorrect cookie domain handling in tailm... * SECURITY UPDATE: Incorrect cookie domain handling in tailmatch()   - debian/patches/curl-tailmatch.patch: enforce strict subdomain match     when sending cookies. Patch from YAMADA Yasuharu.   - http://curl.haxx.se/curl-tailmatch.patch   - CVE-2013-1944	Seth Arnold	7.19.7-1ubuntu1.2	11 years ago
42		* SECURITY UPDATE: libcurl unconditional credential delegati... * SECURITY UPDATE: libcurl unconditional credential delegation during   GSSAPI authentication vulnerability.   - debian/patches/0001-Curl_input_negotiate-do-not-delegate-credentials.patch:     do not delegate credentials when doing GSSAPI authentication   - CVE-2011-2192 * SECURITY UPDATE: libcurl zlib automatic decompression callback   data buffer overflow   - debian/patches/libcurl-contentencoding.patch: restrict amount of     callback data sent to an application   - CVE-2010-0734	Steve Beattie	7.19.7-1ubuntu1.1	12 years ago
41		* Merge with Debian testing. Remaining changes: * Merge with Debian testing.  Remaining changes:   - Keep build deps in main:     - Drop build dependencies: stunnel, libdb4.6-dev, libssh2-1-dev     - Add build-dependency on openssh-server     - Drop libssh2-1-dev from libcurl4-openssl-dev's Depends.	Kees Cook	7.19.7-1ubuntu1	14 years ago
40		* SECURITY UPDATE: SSL cert hostname checking bypass with NU... * SECURITY UPDATE: SSL cert hostname checking bypass with NULL byte.   - add debian/patches/cert-null-cn: backported upstream changes.   - CVE-2009-2417	Kees Cook	7.19.5-1ubuntu2	14 years ago
39		* Merge from Debian unstable (LP: #380281), remaining change... * Merge from Debian unstable (LP: #380281), remaining changes:   - Drop build dependencies: stunnel, libdb4.6-dev, libssh2-1-dev   - Add build-dependency on openssh-server   - Drop libssh2-1-dev from libcurl4-openssl-dev's Depends.   - Call automake-1.9 with --add-missing --copy --force * Fixes LP: #379477	Bhavani Shankar	7.19.5-1ubuntu1	14 years ago
38		* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes:   - Drop build dependencies: stunnel, libdb4.6-dev, libssh2-1-dev   - Add build-dependency on openssh-server   - Drop libssh2-1-dev from libcurl4-openssl-dev's Depends.   - Call automake-1.9 with --add-missing --copy --force * drop debian/patches/security_CVE-2009-0037.patch    - this patch is part of 7.19.4	Michael Vogt	7.19.4-1ubuntu1	14 years ago
37		* SECURITY UPDATE: add fix for CVE-2009-0037 back in * SECURITY UPDATE: add fix for CVE-2009-0037 back in   - debian/patches/security_CVE-2009-0037.patch: updated patch to add missing     section to lib/easy.c   - CVE-2009-0037	Marc Deslauriers	7.18.2-8ubuntu4	15 years ago
36		Revert last patch due to https regression (LP: #337501) Revert last patch due to https regression (LP: #337501)	Jamie Strandboge	7.18.2-8ubuntu3	15 years ago
35		* SECURITY UPDATE: Local file exposure via redirect * SECURITY UPDATE: Local file exposure via redirect   - debian/patches/security_CVE-2009-0037.patch: add logic to lib/url.c and     lib/urldata.h to limit what protocols curl will automatically follow via a     redirect. By default, it now follows all protocols except FILE and SCP.   - CVE-2009-0037	Marc Deslauriers	7.18.2-8ubuntu2	15 years ago
34		* Merge from debian unstable, remaining changes: LP: #314279 * Merge from debian unstable, remaining changes: LP: #314279   - Drop the stunnel build dependency.   - Drop the build-dependency on libdb4.5-dev   - Add build-dependency on openssh-server   - Call automake-1.9 with --add-missing --copy --force.   - Drop libssh2-1-dev from libcurl4-openssl-dev's Depends.	Bhavani Shankar	7.18.2-8ubuntu1	15 years ago
33		* drop change: * drop change:    - "Added Recommends: on ca-certificate for curl package", libcurl3     has a depends on ca-certificates already	Michael Vogt	7.18.2-7ubuntu2	15 years ago
32		* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes:   - Drop the stunnel build dependency.   - Drop the build-dependency on libdb4.5-dev   - Add build-dependency on openssh-server   - Drop libssh2-1-dev from libcurl4-openssl-dev's Depends.   - Call automake-1.9 with --add-missing --copy --force   - Added Recommends: on ca-certificate for curl package	Michael Vogt	7.18.2-7ubuntu1	15 years ago

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1