buildroot/package/libcurl, branch 2017.02

libcurl: security bump to version 7.53.0

2017-02-23T20:35:11+00:00

Fixes CVE-2017-2629 - curl SSL_VERIFYSTATUS ignored >From the advisory (http://www.openwall.com/lists/oss-security/2017/02/21/6): Curl and libcurl support "OCSP stapling", also known as the TLS Certificate Status Request extension (using the `CURLOPT_SSL_VERIFYSTATUS` option). When telling curl to use this feature, it uses that TLS extension to ask for a fresh proof of the server's certificate's validity. If the server doesn't support the extension, or fails to provide said proof, curl is expected to return an error. Due to a coding mistake, the code that checks for a test success or failure, ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. Contrary to how it used to function and contrary to how this feature is documented to work. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. Signed-off-by: Peter Korsgaard

libcurl: optional verbose strings config

2017-02-01T21:01:50+00:00

This patch enables a config to set --enable-verbose during the configuration of libcurl. The option is triggered by setting BR2_PACKAGE_LIBCURL_VERBOSE. Signed-off-by: Judd Meinders Signed-off-by: Matt Weber Signed-off-by: Thomas Petazzoni

libcurl: security bump to 7.52.1

2016-12-23T21:29:23+00:00

Fixes CVE-2016-9594 - Unitilized random Libcurl's (new) internal function that returns a good 32bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to. Signed-off-by: Peter Korsgaard

libcurl: security bump to 7.52.0

2016-12-21T18:44:44+00:00

Fixes CVE-2016-9586 - printf floating point buffer overflow For details, see: https://curl.haxx.se/docs/adv_20161221A.html Signed-off-by: Peter Korsgaard

libcurl: move site to https

2016-11-03T21:31:05+00:00

Saves a redirect. Signed-off-by: Baruch Siach Signed-off-by: Thomas Petazzoni

libcurl: bump version to 7.51.0 (security)

2016-11-02T16:25:20+00:00

List of fixed CVEs: CVE-2016-8615: cookie injection for other servers CVE-2016-8616: case insensitive password comparison CVE-2016-8617: OOB write via unchecked multiplication CVE-2016-8618: double-free in curl_maprintf CVE-2016-8619: double-free in krb5 code CVE-2016-8620: glob parser write/read out of bounds CVE-2016-8621: curl_getdate read out of bounds CVE-2016-8622: URL unescape heap overflow via integer truncation CVE-2016-8623: Use-after-free via shared cookies CVE-2016-8624: invalid URL parsing with '#' CVE-2016-8625: IDNA 2003 makes curl use wrong host Full ChangeLog: https://curl.haxx.se/changes.html#7_51_0 Signed-off-by: Vicente Olivert Riera Signed-off-by: Thomas Petazzoni

libcurl: bump version to 7.50.3

2016-09-14T19:45:58+00:00

Signed-off-by: Vicente Olivert Riera Signed-off-by: Peter Korsgaard

libcurl: bump version to 7.50.2

2016-09-07T10:17:28+00:00

Signed-off-by: Vicente Olivert Riera Signed-off-by: Peter Korsgaard

libcurl: security bump version to 7.50.1

2016-08-03T18:50:39+00:00

Contains fixes for CVE-2016-5419..5421: https://curl.haxx.se/docs/vuln-7.50.0.html [Peter: extend commit message with CVE info] Signed-off-by: Vicente Olivert Riera Signed-off-by: Peter Korsgaard

libcurl: bump version to 7.50.0

2016-07-21T11:56:15+00:00

Signed-off-by: Vicente Olivert Riera Signed-off-by: Thomas Petazzoni