|
curl (8.20.0-2ubuntu11.1) stonking-security; urgency=medium
[ Charles Cochran ]
* SECURITY UPDATE: Out-of-bounds read in GnuTLS send path.
- debian/patches/CVE-2026-107928.patch: reject a gnutls_record_send()
return value larger than the length given in lib/vtls/gtls.c.
- CVE-2026-107928
* SECURITY UPDATE: Improper connection reuse with CURLOPT_INTERFACE.
- debian/patches/CVE-2026-107929.patch: include the CURLOPT_INTERFACE
binding in the connection reuse match in lib/cf-socket.c, lib/setopt.c,
lib/url.c, lib/urldata.h.
- CVE-2026-107929
* SECURITY UPDATE: Information exposure from stale AWS SigV4 authentication.
- debian/patches/CVE-2026-86409.patch: clear CURLAUTH_AWS_SIGV4 when
CURLOPT_AWS_SIGV4 is set to NULL in lib/setopt.c, tests/data/test1978,
tests/libtest/lib1978.c.
- CVE-2026-86409
* SECURITY UPDATE: Missing SSH host verification when redirected to SFTP/SCP.
- debian/patches/CVE-2026-86410.patch: always set the SSH host verification
options, falling back to ~/.ssh/known_hosts in src/config2setopts.c.
- CVE-2026-86410
* SECURITY UPDATE: Cookie jar data loss from an unloadable cookie.
- debian/patches/CVE-2026-86412.patch: ignore individual cookie errors,
except out of memory, when loading a cookie jar in lib/cookie.c.
- CVE-2026-86412
* SECURITY UPDATE: Credential exposure to an HTTP proxy in CONNECT.
- debian/patches/CVE-2026-86414.patch: do not react to 401 responses to a
CONNECT request in lib/cf-h1-proxy.c, lib/cf-h2-proxy.c,
tests/data/Makefile.am, tests/data/test2173.
- CVE-2026-86414
* SECURITY UPDATE: Improper handling of HSTS entries on load.
- debian/patches/CVE-2026-87862.patch: match only the exact host, not
parent domains, when removing duplicates while loading an HSTS file in
lib/hsts.c, tests/data/Makefile.am, tests/data/test3109.
- CVE-2026-87862
* SECURITY UPDATE: Data loss from out-of-range HSTS max-age.
- debian/patches/CVE-2026-87863.patch: cap max-age to two years and skip
entries whose expiry cannot be formatted in lib/hsts.c,
tests/data/Makefile.am, tests/data/test1862.
- CVE-2026-87863
* SECURITY UPDATE: Command injection in IMAP APPEND with CURLOPT_CRLF.
- debian/patches/CVE-2026-87864.patch: reject APPEND when CRLF conversion
makes the upload size unknown in lib/imap.c.
- CVE-2026-87864
* SECURITY UPDATE: Improper host key verification with libssh2 hashed
known_hosts.
- debian/patches/CVE-2026-87865.patch: match hashed known_hosts entries by
host before accepting them as found in lib/vssh/libssh2.c,
tests/data/Makefile.am, tests/libtest/Makefile.am, tests/data/test3500,
tests/libtest/test3500.pl.
- CVE-2026-87865
* SECURITY UPDATE: Cookie jar parsing abort on over-long cookie lines.
- debian/patches/CVE-2026-92386.patch: accept cookie jar lines slightly
longer than MAX_COOKIE_LINE so that a full cookie fits in lib/cookie.c.
- CVE-2026-92386
* SECURITY UPDATE: Denial of service from unbounded response reading in FTP,
IMAP, POP3 and SMTP.
- debian/patches/CVE-2026-92387.patch: add a maximum loop counter to
Curl_pp_readresp in lib/pingpong.c.
- CVE-2026-92387
* SECURITY UPDATE: Use after free in FTP wildcard matching.
- debian/patches/CVE-2026-92388-1.patch: stop overwriting set.write_func
and set.out in lib/cw-out.c, lib/ftp-int.h, lib/ftp.c,
lib/ftplistparser.c, lib/ftplistparser.h.
- debian/patches/CVE-2026-92388-2.patch: only use the list parser in the
CURLWC_MATCHING state in lib/ftplistparser.c.
- CVE-2026-92388
* SECURITY UPDATE: Information exposure from TFTP transfer direction
confusion.
- debian/patches/CVE-2026-92389.patch: return CURLE_TFTP_ILLEGAL when a
server response does not match the transfer direction in lib/tftp.c.
- CVE-2026-92389
* SECURITY UPDATE: Improper file overwrite protection with
--remote-header-name.
- debian/patches/CVE-2026-92390.patch: buffer headers until the remote
filename is selected in src/tool_cb_hdr.c, tests/data/Makefile.am,
tests/data/test3037, tests/data/test3038.
- CVE-2026-92390
* SECURITY UPDATE: Stack overflow from deeply nested MIME structures.
- debian/patches/CVE-2026-92391.patch: free MIME handles non-recursively in
curl_mime_free in lib/mime.c, tests/data/Makefile.am,
tests/libtest/Makefile.inc, tests/data/test3595, tests/libtest/lib3595.c.
- CVE-2026-92391
* SECURITY UPDATE: Credential exposure in CURLINFO_EFFECTIVE_URL.
- debian/patches/CVE-2026-94266.patch: return a copy of the URL without
credentials for CURLINFO_EFFECTIVE_URL in lib/getinfo.c, lib/transfer.c,
lib/url.c, lib/urldata.h, tests/data/Makefile.am, tests/data/test1876.
- CVE-2026-94266
[ Marc Deslauriers ]
* SECURITY UPDATE: HTTP/2 upload Use-After-Free
- debian/patches/CVE-2026-92392.patch: multi: adjust the cleanup order in
multi_done in lib/multi.c.
- CVE-2026-92392
-- Marc Deslauriers Fri, 16 Oct 2026 09:34:53 -0400
|
