buildroot/package/libcurl/libcurl.hash, branch 2017.11

libcurl: security bump to version 7.57.0

2017-11-30T09:29:57+00:00

Fixes the following security issues: - CVE-2017-8816: NTLM buffer overflow via integer overflow - CVE-2017-8817: FTP wildcard out of bounds read - CVE-2017-8818: SSL out of buffer access For more details, see the changelog: https://curl.haxx.se/changes.html#7_57_0 Signed-off-by: Peter Korsgaard

libcurl: security bump to version 7.56.1

2017-10-25T07:44:09+00:00

Fixes CVE-2017-1000257 - IMAP FETCH response out of bounds read https://curl.haxx.se/docs/adv_20171023.html Signed-off-by: Peter Korsgaard

libcurl: security bump to version 7.56.0

2017-10-05T20:40:14+00:00

Drop upstreamed patch. Fixes CVE-2017-1000254 - FTP PWD response parser out of bounds read: https://curl.haxx.se/docs/adv_20171004.html Signed-off-by: Peter Korsgaard

libcurl: bump to version 7.55.1

2017-09-09T20:18:10+00:00

Drop upstream patch. Add license hash. Signed-off-by: Baruch Siach Signed-off-by: Thomas Petazzoni

libcurl: security bump to version 7.55.0

2017-08-11T10:42:34+00:00

Fixes: glob: do not parse after a strtoul() overflow range (CVE-2017-1000101) tftp: reject file name lengths that don't fit (CVE-2017-1000100) file: output the correct buffer to the user (CVE-2017-1000099) Switch to .tar.xz to save bandwidth. Add reference to tarball signature. Signed-off-by: Baruch Siach Signed-off-by: Arnout Vandecappelle (Essensium/Mind)

libcurl: bump version to 7.54.1

2017-06-21T20:42:54+00:00

Signed-off-by: Adam Duskett Signed-off-by: Thomas Petazzoni

libcurl: bump version to 7.54.0 (security)

2017-04-20T21:13:07+00:00

Security fixes: - CVE-2017-7468: switch off SSL session id when client cert is used Full changelog: https://curl.haxx.se/changes.html Removing 0001-CVE-2017-7407.patch. It's included in this release: https://github.com/curl/curl/commit/1890d59905414ab84a35892b2e45833654aa5c13 Signed-off-by: Vicente Olivert Riera Signed-off-by: Thomas Petazzoni

libcurl: bump version to 7.53.1

2017-03-10T20:52:40+00:00

Signed-off-by: Vicente Olivert Riera Signed-off-by: Thomas Petazzoni

libcurl: security bump to version 7.53.0

2017-02-23T20:35:11+00:00

Fixes CVE-2017-2629 - curl SSL_VERIFYSTATUS ignored >From the advisory (http://www.openwall.com/lists/oss-security/2017/02/21/6): Curl and libcurl support "OCSP stapling", also known as the TLS Certificate Status Request extension (using the `CURLOPT_SSL_VERIFYSTATUS` option). When telling curl to use this feature, it uses that TLS extension to ask for a fresh proof of the server's certificate's validity. If the server doesn't support the extension, or fails to provide said proof, curl is expected to return an error. Due to a coding mistake, the code that checks for a test success or failure, ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. Contrary to how it used to function and contrary to how this feature is documented to work. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. Signed-off-by: Peter Korsgaard

libcurl: security bump to 7.52.1

2016-12-23T21:29:23+00:00

Fixes CVE-2016-9594 - Unitilized random Libcurl's (new) internal function that returns a good 32bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to. Signed-off-by: Peter Korsgaard