~ubuntu-branches/ubuntu/quantal/curl/quantal-security : changes

~ubuntu-branches/ubuntu/quantal/curl/quantal-security » Changes from revision 70

From Revision 70 to 51

Rev	Summary	Authors	Tags	Date
70	* SECURITY UPDATE: wrong re-use of connections * SECURITY UPDATE: wrong re-use of connections - debian/patches/CVE-2014-0138.patch: fix possible issues with NTLM HTTP logic, and extend new connection logic to other protocols in lib/http.c, lib/url.c, lib/urldata.h, add new tests to tests/data/Makefile.am, tests/data/test1418, tests/data/test1419. - CVE-2014-0138 * SECURITY UPDATE: incorrect wildcard SSL certificate validation with literal IP addresses - debian/patches/CVE-2014-0139.patch: fix wildcard logic in lib/ssluse.c. - CVE-2014-0139 * debian/patches/fix_test172.path: fix expired cookie causing test to fail. * debian/patches/disable_test519.path: disable test 519 as security update causes it to hang. Fixing this would require backporting new logic into tests/server/sws.c.	Marc Deslauriers	7.27.0-1ubuntu1.9	10 years ago
69	* SECURITY UPDATE: information disclosure via incorrect NTLM... * SECURITY UPDATE: information disclosure via incorrect NTLM credential reuse - debian/patches/CVE-2014-0015.patch: don't reuse connections if NTLM auth is used in lib/url.c. - CVE-2014-0015	Marc Deslauriers	7.27.0-1ubuntu1.8	10 years ago
68	* SECURITY UPDATE: missing CN verification when signature ve... * SECURITY UPDATE: missing CN verification when signature verification is disabled in GnuTLS backend. - debian/patches/CVE-2013-6422.patch: still verify host when CURLOPT_SSL_VERIFYPEER isn't set in lib/gtls.c. - CVE-2013-6422	Marc Deslauriers	7.27.0-1ubuntu1.7	10 years ago
67	* SECURITY REGRESSION: can't disable cert checking in comman... * SECURITY REGRESSION: can't disable cert checking in command line tool (LP: #1258366) - debian/patches/CVE-2013-4545.patch: properly disable host verification when insecure mode is used in src/tool_operate.c. - CVE-2013-4545	Marc Deslauriers	7.27.0-1ubuntu1.6	10 years ago
66	* SECURITY UPDATE: missing CN verification when signature ve... * SECURITY UPDATE: missing CN verification when signature verification is disabled. - debian/patches/CVE-2013-4545.patch: still verify host when CURLOPT_SSL_VERIFYPEER isn't set in lib/ssluse.c. - CVE-2013-4545	Marc Deslauriers	7.27.0-1ubuntu1.5	10 years ago
65	* SECURITY UPDATE: denial of service and possible code execu... * SECURITY UPDATE: denial of service and possible code execution via heap overflow in URL decoder - debian/patches/CVE-2013-2174.patch: fix overflow in lib/escape.c, added tests to tests/data/Makefile.am, tests/data/test1396, tests/unit/Makefile.inc, tests/unit/unit1396.c. - CVE-2013-2174	Marc Deslauriers	7.27.0-1ubuntu1.3	10 years ago
64	* SECURITY UPDATE: Incorrect cookie domain handling in tailm... * SECURITY UPDATE: Incorrect cookie domain handling in tailmatch() - debian/patches/05_curl-tailmatch.patch: enforce strict subdomain match when sending cookies. Patch from YAMADA Yasuharu. - http://curl.haxx.se/curl-tailmatch.patch - CVE-2013-1944	Seth Arnold	7.27.0-1ubuntu1.2	11 years ago
63	* SECURITY UPDATE: arbitrary code execution via sasl buffer ... * SECURITY UPDATE: arbitrary code execution via sasl buffer overflow - debian/patches/CVE-2013-0249.patch: properly limit lengths in lib/curl_sasl.c. - CVE-2013-0249	Marc Deslauriers	7.27.0-1ubuntu1.1	11 years ago
62	* Resynchronise with Debian. Remaining changes: * Resynchronise with Debian. Remaining changes: - Drop dependencies not in main: + Build-Depends: Drop stunnel4 and libssh2-1-dev. + Drop libssh2-1-dev from binary package Depends. - Add new libcurl3-udeb package. - Add new curl-udeb package.	Colin Watson	7.27.0-1ubuntu1	11 years ago
61	* Resynchronise with Debian. Remaining changes: * Resynchronise with Debian. Remaining changes: - Drop dependencies not in main: + Build-Depends: Drop stunnel4 and libssh2-1-dev. + Drop libssh2-1-dev from binary package Depends. - Add new libcurl3-udeb package. - Add new curl-udeb package. * Adjust udeb configure flags handling to something easier to merge in future.	Colin Watson	7.26.0-1ubuntu1	11 years ago
60	Drop libssh2-1-dev Depends (not in main) from libcurl4-gnutl... Drop libssh2-1-dev Depends (not in main) from libcurl4-gnutls-dev and libcurl4-nss-dev too.	Colin Watson	7.25.0-1ubuntu2	11 years ago
59	* Merge from Debian testing (LP: #1003049). Remaining chang... * Merge from Debian testing (LP: #1003049). Remaining changes: - Drop dependencies not in main: + Build-Depends: Drop stunnel4 and libssh2-1-dev. + Drop libssh2-1-dev from libcurl4-openssl-dev's Depends. - Add new libcurl3-udeb package. - Add new curl-udeb package. - Also closes (LP: #855291) * debian/patches/CVE-2012-0036.patch: Dropped. CVE resolved upstream.	Andres Rodriguez	7.25.0-1ubuntu1	11 years ago
58	debian/control: Add missing Depends on libcrypto1.0.0-udeb. debian/control: Add missing Depends on libcrypto1.0.0-udeb.	Andres Rodriguez	7.22.0-3ubuntu4	12 years ago
57	[ Andres Rodriguez ] [ Andres Rodriguez ] * Add curl-udeb package (LP: #940425) [ Dave Walker (Daviey) ] * debian/rules: Remove --add-udeb= for libcurl3, and appended to debian/shlibs.local at build time, which this package seems to be using for undocumented reasoning.	Dave Walker (Daviey)	7.22.0-3ubuntu3	12 years ago
56	* SECURITY UPDATE: URL sanitization vulnerability * SECURITY UPDATE: URL sanitization vulnerability - debian/patches/CVE-2012-0036.patch: reject URLs with embedded control codes in lib/{escape.h,escape.c,imap.c,pop3.c,smtp.c}. - CVE-2012-0036	Marc Deslauriers	7.22.0-3ubuntu2	12 years ago
55	* Merge from Debian unstable, remaining changes: * Merge from Debian unstable, remaining changes: - Drop dependencies not in main: + Build-Depends: Drop stunnel4 and libssh2-1-dev. + Drop libssh2-1-dev from libcurl4-openssl-dev's Depends. - Add new libcurl3-udeb package.	Timo Aaltonen	7.22.0-3ubuntu1	12 years ago
54	* Merge from Debian testing, remaining changes: * Merge from Debian testing, remaining changes: - Drop dependencies not in main: + Build-Depends: Drop stunnel and libssh2-1-dev. + Drop libssh2-1-dev from libcurl4-openssl-dev's Depends. - Add new libcurl3-udeb package, stripped down for use during installation (LP: #831496). * Dropped changes: - debian/patches/timeout_bug_736216: applied upstream.	James Page	7.21.7-3ubuntu1	12 years ago
53	[ James Page, Colin Watson ] [ James Page, Colin Watson ] Add new libcurl3-udeb package, stripped down for use during installation (LP: #831496).	James Page	7.21.6-3ubuntu3	12 years ago
52	debian/patches/timeout_bug_736216: cherry pick upstream debian/patches/timeout_bug_736216: cherry pick upstream git revision d4e000906ac4ef243258a5c9a819a7cde247d16a to fix handshake timeout bug (LP: #736216). Thanks to Sidnei da Silva and Michael Vogt	Jamie Strandboge	7.21.6-3ubuntu2	12 years ago
51	* Restore Ubuntu changes accidentally dropped in previous sy... * Restore Ubuntu changes accidentally dropped in previous sync: - Drop dependencies not in main: + Build-Depends: Replace libssh2-1-dev with openssh-server. Drop stunnel since it's in universe, as well. + Drop libssh2-1-dev from libcurl4-openssl-dev's Depends.	Steve Langasek	7.21.6-3ubuntu1	12 years ago

Older »