ALT Linux repos
| S: | 8.3.0-alt1 |
| 5.0: | 7.19.4-alt0.M50.2 |
| 4.1: | 7.18.1-alt3.M41.3 |
| 4.0: | 7.17.1-alt4.M40.2 |
| 3.0: | 7.15.0-alt1 |
| +updates: | 7.15.0-alt2 |
Other repositories
| Upstream: | 7.18.0 |
Group :: Networking/File transfer
RPM: curl
Navigation
Main Changelog Spec Patches Sources Download Gear Bugs and FR Repocop
13 september 2023 Anton Farygin <rider at altlinux.ru> 8.3.0-alt1
- 8.2.1 -> 8.3.0
- Fixes:
* CVE-2023-38039 HTTP headers eat all memory - relaxed check on armh
- 8.2.0 -> 8.2.1
- 8.1.2 -> 8.2.0
- Fixes:
* CVE-2023-32001 fopen race condition
- built with ngtcp 0.16 and nghttp3 (apply patches from upstream git)
- 8.1.0 -> 8.1.2
- built with Gnutls only if QUIC is available
- 8.0.1 -> 8.1.0
- descreased the number of tests: apache2-* was removed from BuildRequires to
avoid circular dependencies curl -> apache2-mods -> libcurl - Fixes:
* CVE-2023-28319 UAF in SSH sha256 fingerprint check
* CVE-2023-28320 siglongjmp race condition
* CVE-2023-28321 IDN wildcard match
* CVE-2023-28322 more POST-after-PUT confusion
- disable build static library
- fix configure options
- fix build with libssh2
- build with WebSockets support
- build with gnutls instead of openssl, and build with http3 support
- increased the number of tests to be execute
- 8.0.0 -> 8.0.1
- 7.88.1 -> 8.0.0 (Fixes: CVE-2023-27533, CVE-2023-27534, CVE-2023-27535, CVE-2023-27536,
CVE-2023-27537, CVE-2023-27538)
- 7.88.0 -> 7.88.1
- 7.87.0 -> 7.88.0 (Closes: #45281)
- Fixes:
* CVE-2023-23914: HSTS ignored on multiple requests
* CVE-2023-23915: HSTS amnesia with --parallel
* CVE-2023-23916: HTTP multi-header compression denial of service
- 7.86.0 -> 7.87.0
- Fixes:
* CVE-2022-43551: Another HSTS bypass via IDN
* CVE-2022-43552: HTTP Proxy deny use-after-free
- 7.85.0 -> 7.86.0
- Fixes:
* CVE-2022-32221: POST following PUT confusion
* CVE-2022-35260: .netrc parser out-of-bounds access
* CVE-2022-42915: HTTP proxy double-free
* CVE-2022-42916: HSTS bypass via IDN
- 7.84.0 -> 7.85.0
- Fixes:
* CVE-2022-35252: control code in cookie denial of service
- backport upstream fixes:
+ lib3026: reduce the number of threads to 100 (#9172)
+ easy_lock.h: include sched.h if available to fix build (#9054)
- 7.84.0
- Fixes:
* CVE-2022-32208: FTP-KRB bad message verification
* CVE-2022-32207: Unpreserved file permissions
* CVE-2022-32206: HTTP compression denial of service
* CVE-2022-32205: Set-Cookie denial of service
- 7.83.1
- Fixes:
* CVE-2022-30115: HSTS bypass via trailing dot
* CVE-2022-27782: TLS and SSH connection too eager reuse
* CVE-2022-27781: CERTINFO never-ending busy-loop
* CVE-2022-27780: percent-encoded path separator in URL host
* CVE-2022-27779: cookie for trailing dot TLD
* CVE-2022-27778: curl removes wrong file on error
- 7.83.0 (Fixes: CVE-2022-22576, CVE-2022-27774, CVE-2022-27775, CVE-2022-27776)
- 7.81.0 -> 7.82.0
- disabled rewindaftersend logic for auth via kerberos to resolve problems with
hdfs (fix for curl issue #8264)
- 7.80.0 -> 7.81.0
- 7.79.1 -> 7.80.0
- 7.79.1
- added patches from curl upstream:
* b2e72d2 http: fix the broken >3 digit response code detection
* e0742ce Curl_http2_setup: don't change connection data on repeat invokes
- 7.79.0
- Fixes:
* CVE-2021-22945 clear the leftovers pointer when sending succeeds
* CVE-2021-22946 do not ignore --ssl-reqd
* CVE-2021-22947 reject STARTTLS server response pipelining
- fixed FTBFS via -ffat-lto-objects
- 7.78.0
- 7.77.0
- Fixes:
* CVE-2021-22897 schannel cipher selection surprise
* CVE-2021-22898 TELNET stack contents disclosure
* CVE-2021-22901 TLS session caching disaster
- 7.76.1
- 7.76.0
- Fixes:
* CVE-2021-22876 strip credentials from the auto-referer header field
* CVE-2021-22890 add 'isproxy' argument to Curl_ssl_get/addsessionid()
- 7.75.0
- 7.74.0
- Fixes:
* CVE-2020-8286 Inferior OCSP verification
* CVE-2020-8285 FTP wildcard stack overflow
* CVE-2020-8284 trusting FTP PASV responses
- 7.73.0
- 7.72.0
- fixes:
* CVE-2020-8231: libcurl: wrong connect-only connection
- 7.71.1
- add python3 to BR for tests
- 7.71.0
- fixes:
* CVE-2020-8177: curl overwrite local file with -J
* CVE-2020-8169: Partial password leak over DNS on HTTP redirect
- 7.70.0
- removed DEV from version string (with maketgz script)
- 7.69.1
- 7.69.0
- 7.68.0
- 7.67.0
- 7.66.0
- fixes:
* CVE-2019-5481: FTP-KRB double-free
* CVE-2019-5482: TFTP small blocksize heap buffer overflow
- 7.65.3
- 7.65.1
- 7.65.0
- fixes:
* CVE-2019-5435: Integer overflows in curl_url_set
* CVE-2019-5436: tftp: use the current blksize for recvfrom
- 7.64.1
- increased level of verbosity in make check stage
- 7.64.0
- fixes:
* CVE-2018-16890: NTLM type-2 out-of-bounds buffer read
* CVE-2019-3822: NTLMv2 type-3 header stack buffer overflow
* CVE-2019-3823: SMTP end-of-response out-of-bounds read
- 7.63.0
- enabled idn support (closes: #34103)
- enabled ldap support
- enabled brotli support
- added nghttp2 knob (on by default)
- 7.62.0
- fixes:
* CVE-2018-16839 - buffer overrun in the SASL authentication code.
* CVE-2018-16840 - use-after-free in handle close
* CVE-2018-16842 - warning message out-of-buffer read
- enabled HTTP/2 support
- 7.61.1 (fixes: CVE-2018-14618)
- Rebuilt with openssl 1.1.
- Added BR: libkrb5-devel.
- 7.61.0
- fixes:
* CVE-2018-0500 SMTP send heap buffer overflow
- 7.60.0
- fixes:
* CVE-2018-1000300 FTP shutdown response buffer overflow
* CVE-2018-1000301 RTSP bad headers buffer over-read
- new version
- fixes:
* CVE-2018-1000120 FTP path trickery leads to NIL byte out of bounds write
* CVE-2018-1000121 LDAP NULL pointer dereference
* CVE-2018-1000122 RTSP RTP buffer over-read
- new version
- fixes:
* CVE-2018-1000005 HTTP/2 trailer out-of-bounds read
* CVE-2018-1000007 HTTP authentication leak in redirects
- new version
- fixes:
* CVE-2017-8818 SSL out of buffer access
* CVE-2017-8817 FTP wildcard out of bounds read
* CVE-2017-8816 NTLM buffer overflow via integer overflow
- new version
- fixes:
* CVE-2017-1000257 libcurl contains a buffer overrun flaw in the IMAP handler
- new version
- fixes:
* CVE-2017-1000254 libcurl may read outside of a heap allocated buffer when doing FTP.
- new version
- new version with following security fixes:
* CVE-2017-1000101 glob: do not parse after a strtoul() overflow range
* CVE-2017-1000100 tftp: reject file name lengths that don't fit
* CVE-2017-1000099 file: output the correct buffer to the user
- new version with security fixes:
CVE-2017-9502: URL file scheme drive letter buffer overflow
- new version with security fixes:
CVE-2016-5419: TLS session resumption client cert bypass (again)
- new version
- new version with security fixes:
CVE-2017-2629: SSL_VERIFYSTATUS ignored
- new version with security fixes:
CVE-2016-9594: uninitialized random
- new version with security fixes:
CVE-2016-9586: printf floating point buffer overflow
- enabled gssapi (closes: #32862)
- new version with security fixes:
CVE-2016-8615: cookie injection for other servers
CVE-2016-8616: case insensitive password comparison
CVE-2016-8617: OOB write via unchecked multiplication
CVE-2016-8618: double-free in curl_maprintf
CVE-2016-8619: double-free in krb5 code
CVE-2016-8620: glob parser write/read out of bounds
CVE-2016-8621: curl_getdate read out of bounds
CVE-2016-8622: URL unescape heap overflow via integer truncation
CVE-2016-8623: Use-after-free via shared cookies
CVE-2016-8624: invalid URL parsing with '#'
CVE-2016-8625: IDNA 2003 makes curl use wrong host
- libcurl-devel: packaged libcurl.m4
- new version with security fixes (CVE-2016-7167)
- new version
- new version
- new version
- new version
- new version
- new version
- new version
- enabled http2 support (closes: #31617)
- new version
- new version
- new version, with fixes for CVE-2015-3236, CVE-2015-3237
- new version, with fixes for CVE-2015-3153
- new version, with fixes for CVE-2015-3148, CVE-2015-3143, CVE-2015-3145
and CVE-2015-3144
- new version
- new version
- new version
- threaded-resolver: revert Curl_expire_latest() switch (closes: #30427)
- new version
- new version
- new version
- new version
- added watch file
- test172 fixed by upstream
- new version
- new version
- new version
- new version
- new version
- new version
- Fix NULL pointer reference when closing an unused multi handle (closes: #28534)
- new version
- new version
- new version
- new version (fixes two separate security vulnerabilities)
- new version
- new version
- new version (CVE-2011-2192)
- new version
- fix curl-config script:
+ version: replace VERSION with CURLVERSION
+ checkfor: add Requires: bc
- new version
- libcurl-devel: removed dependencies on libidn-devel libssl-devel zlib-devel
- applied debug.patch from Fedora to enable -g in CFLAGS
- new version
- enabled test check
- new version
- test suite temporary disabled (it does not work in hasher)
- new version
- Removed unused requirement on libcares.
- Cleaned up package descriptions.
- Enabled test suite.
- Built with libssl.so.10.
- build without libcares (fixed #23891,#23486)
- new version
- enabled build with libssh2
- new version
- new version
- new version
- new version
- new version (CVE-2009-2417)
- build curl with really external libcares (fixed #19097)
- new version (CVE-2009-0037)
- build from cvs
- curl-config --libs fixed (#18779)
- new version
- new version
- post-ldconfig removed
- new version
- enabled c-ares support (#17101)
- new version
- new version
- new version
- new version
- disabled ldap support
- new version
- new version
- removed patch1 (included to mainstream)
- removed unsused patch0
- added patch to ftp from sbolshakov@. Fixed anonymous login on some non-standart servers
- new version with security fixes (CVE-2007-3564)
- disabled kerberos support (by requiest from krb5 mantainer)
- new version
- new version
- fixed curl-config --libs and libcurl.pc (unneeded libs removed)
- use ca-certificates
- build with gssapi support
- updated build requires
- new version
- new version (soname changed)
- new version
- new version
- new version
- new version
- new version
- new version
- 7.13.1
- libcurl-devel: added requires to libidn-devel libssl-devel zlib-devel
- new version
- new version
- new version
- new version
- new version
- new version
- new version
- new version
- 7.10.4
- 7.10.3
- new version
- 7.10
- 7.9.8
- 7.9.7
- 7.9.6
- 7.9.5
- 7.9.4
- 7.9.2
- russian summary and description
- 7.9
- 7.8.1
- Fixed:
+ curl-config moved to libcurl-devel
+ curl-config(1) moved to libcurl-devel
- 7.7.3
- 7.7.2
- 7.7.1
- 7.6
- RE adaptions.
- change lisence, according to the author's will (reported by F. Crozat)
- added some sample codes to the -devel package
- 7.5.2
- small spec updates
- corrected URL
- 7.5.1
- manually include fcntl.h, strangely, it has been left out (sucky!!!).
- new and shiny source.
- requires: curl = %version
- really 7.4.2.
- well we compile with ssl now, so obviously description is wrong (daoudascks)
- compiled with ssl (from TitiSux)
- relase pre4.
- fiw requires
- new release
- 7.4.1
- used srpm from Anton Graham <darkimage@bigfoot.com> :
- new version
- new -lib and -devel packages
- change description
- clean spec
- Macroification
- First Mandrake build