Debian Patches
Status for curl/7.88.1-10+deb12u15
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| CVE-2024-7264-1.patch | x509asn1: unittests and fixes for gtime2str Fix issues in GTime2str() and add unit test cases to verify correct behaviour. Follow-up to 3c914bc6801 Closes #14316 Backported to Debian by Carlos Henrique Lima Melara <charles@debian.org>. Changes: - In this version, GTime2str doesn't return CURLcode, so change that to NULL. - Also change test helper function to match the correct type and pass the correct arguments. In this version, GTime2str doesn't take struct dynbuf *. It's aimed to not FTBFS if someone build the package with --enable-debug. |
Stefan Eissing <stefan@eissing.org> | no | 2024-07-30 | ||
| CVE-2024-8096.patch | gtls: fix OCSP stapling management Closes #14642 |
Daniel Stenberg <daniel@haxx.se> | no | 2024-08-20 | ||
| CVE-2024-9681-0.patch | hsts: improve subdomain handling - on load, only replace existing HSTS entries if there is a full host match - on matching, prefer a full host match and secondary the longest tail subdomain match Closes #15210 Backported by: Aquila Macedo Costa <aquilamacedo@riseup.net>. Changes: - Refresh patch context. |
Daniel Stenberg <daniel@haxx.se> | no | 2024-10-09 | ||
| 04_workaround_as_needed_bug.patch | Work around libtool --as-needed reordering bug =================================================================== |
Alessandro Ghedini <ghedo@debian.org> | not-needed | debian | vendor | 2016-08-03 |
| 08_enable-zsh.patch | Enable zsh completion generation =================================================================== |
Alessandro Ghedini <ghedo@debian.org> | not-needed | vendor | 2016-08-03 | |
| build-Divide-mit-krb5-gssapi-link-flags-between-LDFLAGS-a.patch | build: Divide mit-krb5-gssapi link flags between LDFLAGS and LIBS From the comments nearby about not having --libs-only-L, it looks as though the intention was to apply a split like this to all dependency libraries where possible, and the only reason it was not done for Kerberos is that krb5-config doesn't have that feature and pkg-config was originally not supported here. For example, zlib, libssh and librtmp all have their flags from pkg-config split in this way. Now that pkg-config is supported here, we can do the intended split. |
Simon McVittie <smcv@collabora.com> | no | 2022-11-22 | ||
| 11_omit-directories-from-config.patch | In order to (partially) multi-arch-ify curl-config, remove all mention of @includedir@ and @libdir@ from the script. On Debian, the actual header and library directories are architecture-dependent, but will always be in the C compiler's default search path, so -I and -L options are not necessary (and may be harmful in multi-arch environments.) =================================================================== |
Benjamin Moody <benjamin.moody@gmail.com> | not-needed | debian | vendor | 2017-01-10 |
| Remove-curl-s-LDFLAGS-from-curl-config-static-libs.patch | Remove curl's LDFLAGS from curl-config --static-libs On current Debian bookworm, the LDFLAGS consist of -L/usr/lib/${triplet}/mit-krb5 originating from `pkg-config --libs-only-L mit-krb5-gssapi` from krb5-multidev, plus some linker options that are intended for curl itself rather than for dependent packages. None of these are really desirable, and they create divergence between architectures that would prevent libcurl-*-dev from being Multi-Arch: same. The -L flag is not really needed, for the same reason that -L@libdir@ isn't. curl Build-Depends on libkrb5-dev, which doesn't need a special -L flag to find libgssapi_krb5, and the various libcurl-*-dev packages have Suggests on libkrb5-dev rather than on krb5-multidev for static linking. The other options (currently `-Wl,-z-relro -Wl,-z,now`) are intended for libcurl itself, and if dependent packages want those options then they should set them from their own packaging. |
Simon McVittie <smcv@collabora.com> | not-needed | debian | 2022-11-22 | |
| Use-correct-path-when-loading-libnss-pem-ckbi-.so.patch | Use correct path when loading libnss{pem,ckbi}.so | Sergio Durigan Junior <sergiodj@debian.org> | no | debian | 2023-03-05 | |
| fix-unix-domain-socket.patch | Fixing unix domain socket use in https connects. - refs #10633, when h2/h3 eyeballing was involved, unix domain socket configurations were not honoured - configuring --unix-socket will disable HTTP/3 as candidate for eyeballing - combinatino of --unix-socket and --http3-only will fail during initialisation - adding pytest test_11 to reproduce |
Stefan Eissing <stefan@eissing.org> | no | 2023-02-28 | ||
| openldap-create-ldap-URLs-correctly-for-IPv6-addresses.patch | openldap: create ldap URLs correctly for IPv6 addresses Fixes #13228 Closes #13235 More context: When the user specified an IPv6 address to be used as an LDAP server, curl will fail to properly enclose it in square brackets, which causes the connection to fail because the host address cannot be distinguished from the port: $ curl -v ldap://[fd42:be5:e632:a6b3:216:3eff:feb1:5bc4]:389 ... * LDAP local: Cannot connect to ldap://fd42:be5:e632:a6b3:216:3eff:feb1:5bc4:389, Bad parameter to an ldap routine ... Fix this by always enclosing the IPv6 address in square brackets. |
Daniel Stenberg <daniel@haxx.se> | no | debian | upstream, https://github.com/curl/curl/commit/56935a7dada6975d5a46aa494de0af195e4e8659 | 2024-03-30 |
| large-time-testable-feature.patch | tests: add 'large-time' as a testable feature This allows test cases to require this feature to run and to be used in %if conditions. Large here means larger than 32 bits. Ie does not suffer from y2038. Closes #11696 Backported by: Aquila Macedo Costa <aquilamacedo@riseup.net>. Changes: - Refresh patch context |
Daniel Stenberg <daniel@haxx.se> | no | 2023-08-19 | ||
| dont-stop-stunnel-before-retry.patch | runtests: don't try to stop stunnel before trying again Calling stopserver() before retrying stunnel due to an error would stop the dependent server (such as HTTP) meaning stunnel would have nothing to talk to when it came up. Don't try to force a stop when it didn't actually start. Also, don't mark the server as bad for future use when it starts up on a retry. Fixes #10976 Backported by: Aquila Macedo Costa <aquilamacedo@riseup.net>. Changes: - Apply the changes to `runtests.pl` instead of `servers.pm`, as `servers.pm` does not exist in this version of bookworm. |
Dan Fandrich <dan@coneharvesters.com> | no | 2023-04-17 | ||
| CVE-2023-27533.patch | telnet: only accept option arguments in ascii To avoid embedded telnet negotiation commands etc. Closes #10728 Backported to Debian by Samuel Henrique <samueloph@debian.org> |
Daniel Stenberg <daniel@haxx.se> | no | 2023-03-06 | ||
| CVE-2023-27534.patch | curl_path: create the new path with dynbuf Closes #10729 |
Daniel Stenberg <daniel@haxx.se> | no | 2023-03-09 | ||
| CVE-2023-27538.patch | url: fix the SSH connection reuse check Closes #10735 |
Daniel Stenberg <daniel@haxx.se> | no | 2023-03-10 | ||
| CVE-2023-27535.patch | ftp: add more conditions for connection reuse Closes #10730 |
Daniel Stenberg <daniel@haxx.se> | no | 2023-03-09 | ||
| CVE-2023-27536.patch | url: only reuse connections with same GSS delegation Closes #10731 |
Daniel Stenberg <daniel@haxx.se> | no | 2023-03-10 | ||
| CVE-2023-27537.patch | CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe Closes #10732 |
Daniel Stenberg <daniel@haxx.se> | no | 2023-03-09 | ||
| CVE-2023-28319.patch | libssh2: free fingerprint better Closes #11088 |
Daniel Stenberg <daniel@haxx.se> | no | 2023-05-08 | ||
| CVE-2023-28320.patch | hostip: add locks around use of global buffer for alarm() When building with the sync name resolver and timeout ability we now require thread-safety to be present to enable it. Closes #11030 |
Harry Sintonen <sintonen@iki.fi> | no | 2023-04-25 | ||
| CVE-2023-28320-1.patch | hostip: include easy_lock.h before using GLOBAL_INIT_IS_THREADSAFE Since that header file is the only place that define can be defined. Follow-up to 13718030ad4b3209 Closes #11121 |
Daniel Stenberg <daniel@haxx.se> | no | 2023-05-16 | ||
| CVE-2023-28321.patch | hostcheck: fix host name wildcard checking The leftmost "label" of the host name can now only match against single '*'. Like the browsers have worked for a long time. - extended unit test 1397 for this - move some SOURCE variables from unit/Makefile.am to unit/Makefile.inc Closes #11018 Backported to Debian by Samuel Henrique <samueloph@debian.org> |
Daniel Stenberg <daniel@haxx.se> | no | 2023-04-24 | ||
| CVE-2023-28322.patch | lib: unify the upload/method handling By making sure we set state.upload based on the set.method value and not independently as set.upload, we reduce confusion and mixup risks, both internally and externally. Closes #11017 |
Daniel Stenberg <daniel@haxx.se> | no | 2023-04-25 | ||
| CVE-2023-32001.patch | fopen: optimize Closes #11419 |
SaltyMilk <soufiane.elmelcaoui@gmail.com> | no | 2023-07-10 | ||
| Use-OpenLDAP-specific-functionality.patch | Fix Autotools not enabling OpenLDAP-specific functionality The non-OpenLDAP code paths are less tested, less featureful, less secure, and omitted in the build system by accident. It has been discovered that this also mitigates curl not being able to make LDIF output when attributes have binary values. |
yes | upstream | upstream, https://github.com/curl/curl/commit/0ac6108856b9d500bc376d1d7e0b648d15499837.patch | 2023-07-25 | |
| CVE-2023-38039.patch | http: return error when receiving too large header set To avoid abuse. The limit is set to 300 KB for the accumulated size of all received HTTP headers for a single response. Incomplete research suggests that Chrome uses a 256-300 KB limit, while Firefox allows up to 1MB. Closes #11582 Backport to Debian by Carlos Henrique Lima Melara <charlesmelara@riseup.net> |
Daniel Stenberg <daniel@haxx.se> | no | 2023-08-02 | ||
| CVE-2023-38545.patch | socks: return error if hostname too long for remote resolve Prior to this change the state machine attempted to change the remote resolve to a local resolve if the hostname was longer than 255 characters. Unfortunately that did not work as intended and caused a security issue. Name resolvers cannot resolve hostnames longer than 255 characters. Backported by: Samuel Henrique <samueloph@debian.org> |
Jay Satiro <raysatiro@yahoo.com> | yes | upstream | 2023-09-30 | |
| CVE-2023-38546.patch | cookie: remove unnecessary struct fields make much of a speed difference for most use cases but saves 1.5KB of data per instance. Closes #11862 Backported by: Samuel Henrique <samueloph@debian.org> |
Daniel Stenberg <daniel@haxx.se> | no | 2023-09-14 | ||
| CVE-2023-46218.patch | cookie: lowercase the domain names before PSL checks Closes #12387 Backported by: Samuel Henrique <samueloph@debian.org>: * Update signature of function "bad_domain" |
Daniel Stenberg <daniel@haxx.se> | no | 2023-11-23 | ||
| CVE-2023-46219.patch | fopen: create short(er) temporary file name Only using random letters in the name plus a ".tmp" extension. Not by appending characters to the final file name. Closes #12388 Backported by: Samuel Henrique <samueloph@debian.org>: * The function Curl_rand_alnum was renamed to Curl_rand_hex |
Daniel Stenberg <daniel@haxx.se> | no | 2023-11-23 | ||
| CVE-2024-2004.patch | setopt: Fix disabling all protocols When disabling all protocols without enabling any, the resulting set of allowed protocols remained the default set. Clearing the allowed set before inspecting the passed value from --proto make the set empty even in the errorpath of no protocols enabled. Backported by: Guilherme Puida Moreira <guilherme@puida.xyz> * Small change in the Makefile to add a new test. |
Daniel Gustafsson <daniel@yesql.se> | no | 2024-02-27 | ||
| CVE-2024-2398.patch | http2: push headers better cleanup - provide common cleanup method for push headers Closes #13054 Backported by: Guilherme Puida Moreira <guilherme@puida.xyz>: * Changed h2_stream_ctx to HTTP in free_push_headers. |
Stefan Eissing <stefan@eissing.org> | no | 2024-03-06 | ||
| CVE-2024-7264-0.patch | x509asn1: clean up GTime2str Closes #14307 Backported to Debian by Carlos Henrique Lima Melara <charles@debian.org>. Changes: - In this version, GTime2str doesn't return CURLcode, so change that to NULL. |
Daniel Stenberg <daniel@haxx.se> | no | 2024-07-30 | ||
| CVE-2024-9681-1.patch | tests: 780 - 783, new HSTS tests test780: verify updated HSTS data in response header test781: HSTS update expiry, with parent includeSubDomains domain present test782: HSTS update expiry, with two includeSubDomains domains present test783: HSTS update expiry, removing includesubdomains in update Backported by: Aquila Macedo Costa <aquilamacedo@riseup.net>. Changes: - Adjust `tests/data/Makefile.inc` to include new HSTS tests (780 - 783). - Updates 'Debug' to 'debug' in test data files (`test780`, `test781`, `test782`, `test783`) to align with curl conventions in bookworm and ensure consistency in feature definitions. - Additionally, `%LOGDIR` is replaced with log in the test files due to its absence in curl bookworm. |
Daniel Stenberg <daniel@haxx.se> | no | 2024-10-09 | ||
| url-use-same-credentials-on-redirect.patch | url: use same credentials on redirect Previously it could lose the username and only use the password. Added test 998 and 999 to verify. Fixes #15262 Closes #15282 Backported by: Matheus Polkorny <mpolkorny@gmail.com>. Changes: - Refresh patch context - Small change in the Makefile to add a new test |
Daniel Stenberg <daniel@haxx.se> | no | 2024-10-12 | ||
| CVE-2024-11053.patch | netrc: address several netrc parser flaws - make sure that a match that returns a username also returns a password, that should be blank if no password is found - fix handling of multiple logins for same host where the password/login order might be reversed. - reject credentials provided in the .netrc if they contain ASCII control codes - if the used protocol does not support such (like HTTP and WS do) Add test 478, 479 and 480 to verify. Updated unit 1304. Closes #15586 Backported by: Matheus Polkorny <mpolkorny@gmail.com> Based on the work of Marc Deslauriers <marc.deslauriers@ubuntu.com> for curl 7.81.0-1ubuntu1.20. Changes: - Refresh patch context. - Adjust `%LOGDIR/` to 'log/' due to its absence in bookworm. - Replaces the previous usage of the state_login, state_password, and state_our_login variables with the found_state enum, which includes the values NONE, LOGIN, and PASSWORD. As a result, all conditionals and memory management logic associated with these variables were updated. - Updates to use password and login instead of s_password and s_login, which do not exist in the Bookworm version. This change preserves the same logic while adapting the code to the current structure. - test478 is disabled as this version of curl does not support searching for a specific login in the netrc file. (see https://github.com/curl/curl/issues/8241) - test480 is disabled as this version of curl does not support quoted or escaped strings in the netrc file. (see https://github.com/curl/curl/issues/8908) - Small change in the Makefile to add a new test. |
Daniel Stenberg <daniel@haxx.se> | no | 2024-11-15 | ||
| CVE-2025-0167.patch | netrc: 'default' with no credentials is not a match Test 486 verifies. Closes #15908 Backported by: Dr. Tobias Quathamer <toddy@debian.org> Changes: * Refresh patch context for lib/netrc.c * Use tests/data/Makefile.inc to add new test instead of tests/data/Makefile.am, because that has only been introduced in later versions of curl. * Replace "%LOGDIR" with "log" due to its absence in bookworm. |
Daniel Stenberg <daniel@haxx.se> | no | 2025-01-03 | ||
| CVE-2025-10148.patch | ws: get a new mask for each new outgoing frame Closes #18496 Changes: * Refresh patch context for lib/ws.c * Adapt return value to current function return type Backported by: Samuel Henrique <samueloph@debian.org> Changes: * Apply the per-frame mask generation in ws_packethead() (bookworm 7.88.1) rather than upstream's ws_enc_add_frame() (and trixie's ws_enc_write_head()), since the bookworm code path that builds the outgoing frame header is structurally different. On Curl_rand() failure return 0 -- ws_packethead() already uses 0 as the soft-error sentinel for buffer-too-small. * Preserve the DEBUGBUILD CURL_WS_FORCE_ZERO_MASK escape hatch alongside the new per-frame mask generation, matching upstream. * Remove the corresponding one-time mask generation in Curl_ws_accept(), and initialise `result` to CURLE_OK at declaration since it is no longer unconditionally assigned by the removed Curl_rand() call. |
Daniel Stenberg <daniel@haxx.se> | no | 2025-09-08 | ||
| CVE-2025-14524.patch | curl_sasl: if redirected, require permission to use bearer Closes #19933 * Refresh patch context for lib/curl_sasl.c Backported by: Samuel Henrique <samueloph@debian.org> * Refresh line numbers for bookworm 7.88.1: same functions (Curl_sasl_start and Curl_sasl_continue), -7 line offset. |
Daniel Stenberg <daniel@haxx.se> | no | 2025-12-10 | ||
| CVE-2025-14819.patch | openssl: toggling CURLSSLOPT_NO_PARTIALCHAIN makes a different CA cache Closes #20009 * Refresh patch context for lib/vtls/openssl.c Backported by: Samuel Henrique <samueloph@debian.org> * Bookworm 7.88.1 names the cache struct `multi_ssl_backend_data` (vs `ossl_x509_share` in 8.14.1+) and the helpers `cached_x509_store_*` (without the `ossl_` prefix). Apply the same logic against those names. Replace the upstream `CURL_UNCONST(data)` macro with a plain `(struct Curl_easy *)data` cast since CURL_UNCONST does not exist in bookworm. |
Daniel Stenberg <daniel@haxx.se> | no | 2025-12-17 | ||
| CVE-2026-3783.patch | http: only send bearer if auth is allowed Verify with test 2006 Closes #20843 * Refresh patch context for lib/http.c * Adapt the new tests/data/test2006: reuse the existing test486 as the base (similarity-copy in the diff), keep the test definition structurally as upstream wants but also drop the two now-stale "#" comment lines that already differ between upstream's and our test486. Backported by: Samuel Henrique <samueloph@debian.org> * Bookworm 7.88.1: same output_auth_headers() function, just at line 793 (offset +97 vs trixie). Apply only the lib/http.c hunk. * Drop the test additions: bookworm has neither tests/data/test486 (which trixie's test2006 was copy-derived from) nor a way to add it without pulling in a non-trivial amount of unrelated test infrastructure. The security property is the Curl_auth_allowed_to_host() guard itself; tests are nice-to-have. |
Daniel Stenberg <daniel@haxx.se> | no | 2026-03-06 | ||
| CVE-2026-3784.patch | proxy-auth: additional tests Also eliminate the special handling for socks proxy match. Closes #20837 * Refresh patch context for lib/url.c Backported by: Samuel Henrique <samueloph@debian.org> * Bookworm 7.88.1: same proxy_info_matches and socks_proxy_info_matches functions, just at line 863. Bookworm's proxy_info_matches still uses strcasecompare() (upstream switched to curl_strequal() at some point post-7.88.1), so leave that call alone -- only add the new Curl_timestrcmp() user/passwd check inside it. Keep socks_proxy_info_matches() in place and switch the call site at line 1214 from socks_proxy_info_matches to proxy_info_matches, matching the trixie minimal-diff approach. * Drop the tests/http/test_13_proxy_auth.py and tests/http/testenv/curl.py hunks: bookworm has no tests/http/ pytest infrastructure at all (those tests appeared in upstream later than 7.88.1). |
Stefan Eissing <stefan@eissing.org> | no | 2026-03-06 | ||
| CVE-2026-5773.patch | protocol: disable connection reuse for SMB(S) Connections should only be reused when using the same "share" (and perhaps some additional conditions), but instead of fixing this flaw, this change completely disables connection reuse for SMB. This protocol is about to get dropped soon anyway. Closes #21238 * Upstream removes PROTOPT_CONN_REUSE from the SMB and SMBS scheme registrations in lib/protocol.c. That flag (and the lib/protocol.c scheme registry itself) only exists from upstream commit feea96851230c7a5a11feaffa0a5e4a4d30e5e63 ("conncontrol: reuse handling", Nov 2025) onward, so neither is present in 8.14.1. In 8.14.1 SMB connection reuse is instead controlled at runtime via connkeep() / connclose(), and lib/smb.c explicitly calls connkeep() in smb_connect() to mark SMB connections as eligible for reuse. Replace that connkeep() with a connclose() so SMB connections are marked as not-reusable, achieving the same effect as the upstream change. Backported by: Samuel Henrique <samueloph@debian.org> * Bookworm 7.88.1: same connkeep() call in smb_connect() at line 271. Apply the same connkeep() -> connclose() swap; this version also lacks PROTOPT_CONN_REUSE so the runtime approach is the only way to express "do not reuse this connection". |
Daniel Stenberg <daniel@haxx.se> | no | 2026-04-05 | ||
| CVE-2026-7168.patch | setopt: clear proxy auth properties when switching Verify with test 1588 Closes #21453 * lib/setopt.c: upstream's CURLOPT_PROXY case lives in a dedicated setopt_cptr_proxy() function; in 8.14.1 it is still inline in the setopt_cptr() switch. The setproxy() helper is added directly above setopt_cptr() and the inline Curl_setstropt() call is swapped for setproxy(). * lib/vauth/vauth.h: upstream's hunk also adds a no-op Curl_auth_is_digest_supported() macro to the CURL_DISABLE_DIGEST_AUTH branch, but our 8.14.1 vauth.h has no such #else branch (the file ends the digest block with a bare #endif). Add only the Curl_auth_digest_cleanup(x) no-op macro inside a new #else, which is the part actually needed by setproxy() in disable-digest builds. * tests/data/test1588: regression test from upstream with two changes: crlf="headers" -> crlf="yes" so the 8.14.1 test runner correctly applies CRLF to header lines on both the server-side data and the expected protocol block; and the "digest" entry in <features> is dropped because the 8.14.1 curlinfo emits the feature toggle as "digest-auth" rather than "digest", so the unmodified feature gate would always SKIP the test on this branch. Other digest-auth tests (e.g. test1061) similarly do not list "digest" as a required feature. * tests/libtest/lib1588.c: rewritten to use the 8.14.1 libtest harness (test.h / CURLcode test(char *URL) / easy_init / easy_setopt with goto test_cleanup) instead of upstream's newer first.h-based one. The init1588() helper also reuses the parent's test_cleanup label rather than upstream's separate init_failed label, since 8.14.1's easy_setopt jumps directly to test_cleanup. Backported by: Samuel Henrique <samueloph@debian.org> * Bookworm 7.88.1: lib/setopt.c is a single Curl_vsetopt() function with one big switch (no setopt_cptr() sub-switch like trixie). Add the setproxy() helper just above Curl_vsetopt() instead, and replace the inline Curl_setstropt() in the CURLOPT_PROXY case with `result = setproxy(data, va_arg(param, char *));`. * lib/vauth/vauth.h: bookworm uses CURL_DISABLE_CRYPTO_AUTH (the pre-split spelling) instead of CURL_DISABLE_DIGEST_AUTH. Add the no-op Curl_auth_digest_cleanup(x) macro under the matching #else branch. * Drop the test additions: bookworm has neither the test1588 xml-test infrastructure for CONNECT-based digest replay nor the modern libtest harness (test.h / CURLcode test(char *URL)) the trixie adaptation rewrote against -- backporting the test would require touching the test runner setup more aggressively than is appropriate for a stable update. The security property (proxy auth state cleared on CURLOPT_PROXY change) is the setproxy() helper itself. |
Daniel Stenberg <daniel@haxx.se> | no | 2026-04-27 | ||
| runtests.pl-Increase-variance-of-random-seed-used-for-tes.patch | runtests.pl: Increase variance of random seed used for tests's port designation Patched on Debian to add day, hour and min to the seed, e.g.: 201912091530 The version of curl we ship on bookworm is too prone to port conflicts on tests, this is the least intrusive workaround as it makes each retry use a different seed. Gbp-Pq: Name runtests_port_random_seed_variance.patch |
Samuel Henrique <samueloph@debian.org> | no | 2025-03-09 | ||
| fix-CVE-2023-27534-regression-1.patch | curl_path: bring back support for SFTP path ending in /~ libcurl used to do a directory listing for this case (even though the documentation says a URL needs to end in a slash for this), but 4e2b52b5f7a3 modified the behavior. This change brings back a directory listing for SFTP paths that are specified exactly as /~ in the URL. Fixes #11001 Closes #11023 |
Daniel Stenberg <daniel@haxx.se> | yes | upstream | upstream, https://github.com/curl/curl/commit/91b53efa4b6854dc3688f55bfb329b0cafcf5325 | 2025-06-09 |
| fix-CVE-2023-27534-regression-2.patch | curl_path: make SFTP handle a path like /~ properly. ... without a trailing slash. Fixes #17534 Closes #17542 |
Carlos Henrique Lima Melara <charlesmelara@riseup.net> | yes | upstream | upstream, https://github.com/curl/curl/commit/0ede81dcc61844cecce8904fb4de24319afeb024 | 2025-06-09 |
| 0001-http_chunks-reset-the-trailer-to-avoid-memory-leak.patch | http_chunks: reset the trailer to avoid memory leak | Daniel Stenberg <daniel@haxx.se> | no | 2025-07-15 | ||
| 90_gnutls.patch | Build with GnuTLS. =================================================================== |
Ramakrishnan Muthukrishnan <vu3rdd@gmail.com> | not-needed | vendor | 2018-05-23 | |
| 99_nss.patch | Build with NSS. =================================================================== |
Ramakrishnan Muthukrishnan <vu3rdd@gmail.com> | not-needed | vendor | 2015-08-12 |
All known versions for source package 'curl'
- 8.21.0-2+exp1 (experimental)
- 8.21.0-2 (forky, sid)
- 8.21.0-2~bpo13+1 (trixie-backports)
- 8.14.1-2+deb13u5 (trixie-proposed-updates)
- 8.14.1-2+deb13u4 (trixie)
- 8.14.1-2+deb13u2~bpo13+1 (bookworm-backports)
- 7.88.1-10+deb12u15 (bookworm)
- 7.88.1-10+deb12u5 (bookworm-security)