Bugs fixes in "curl"
| Origin | Bug number | Title | Date fixed |
|---|---|---|---|
| CVE | CVE-2025-14819 | When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally | 2026-02-25 |
| CVE | CVE-2025-14524 | When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, | 2026-02-25 |
| CVE | CVE-2025-14017 | When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally a | 2026-02-25 |
| CVE | CVE-2025-10148 | curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask tha | 2026-02-25 |
| CVE | CVE-2022-32205 | A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficient | 2025-09-29 |
| Launchpad | 2118865 | libcurl outgoing Cookie header field size check is broken | 2025-09-29 |
| CVE | CVE-2022-32205 | A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficient | 2025-09-29 |
| Launchpad | 2118865 | libcurl outgoing Cookie header field size check is broken | 2025-09-29 |
| CVE | CVE-2024-11053 | When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the foll | 2024-12-16 |
| CVE | CVE-2024-11053 | When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the foll | 2024-12-16 |
| CVE | CVE-2024-11053 | When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the foll | 2024-12-16 |
| CVE | CVE-2024-11053 | When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the foll | 2024-12-16 |
| CVE | CVE-2024-9681 | When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than oth | 2024-11-18 |
| CVE | CVE-2024-9681 | When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than oth | 2024-11-18 |
| CVE | CVE-2024-9681 | When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than oth | 2024-11-18 |
| CVE | CVE-2024-9681 | When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than oth | 2024-11-18 |
| CVE | CVE-2024-8096 | When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is v | 2024-09-16 |
| CVE | CVE-2024-8096 | When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is v | 2024-09-16 |
| CVE | CVE-2024-8096 | When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is v | 2024-09-16 |
| CVE | CVE-2024-8096 | When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is v | 2024-09-16 |
About
-
Send Feedback to @ubuntu_updates
