Package "libcurl4-openssl-dev"
| Name: |
libcurl4-openssl-dev
|
Description: |
development files and documentation for libcurl (OpenSSL flavour)
|
| Latest version: |
8.5.0-2ubuntu10.15 |
| Release: |
noble (24.04) |
| Level: |
updates |
| Repository: |
main |
| Head package: |
curl |
| Homepage: |
https://curl.se/ |
Links
Download "libcurl4-openssl-dev"
Other versions of "libcurl4-openssl-dev" in Noble
Changelog
|
curl (8.5.0-2ubuntu10.15) noble-security; urgency=medium
[ Charles Cochran ]
* SECURITY UPDATE: Authentication bypass in LDAP SASL negotiation.
- debian/patches/CVE-2026-13608.patch: openldap: handle
Curl_sasl_continue() returns better in lib/openldap.c.
- CVE-2026-13608
* SECURITY UPDATE: Use after free in HTTP/2 server push.
- debian/patches/CVE-2026-18924.patch: make server push transfers
inherit share from parent in lib/http2.c.
- CVE-2026-18924
* SECURITY UPDATE: Public key pinning bypass.
- debian/patches/CVE-2026-80230.patch: require server cert if public
key pinned in lib/vtls/openssl.c.
- CVE-2026-80230
* SECURITY UPDATE: Cookie injection for public suffix domains.
- debian/patches/CVE-2026-82209.patch: ensure cookies set for an exact
PSL domain are host-only in lib/cookie.c, tests/data/Makefile.inc,
tests/data/test1136, tests/data/test2318.
- CVE-2026-82209
[ Kyle Kernick]
* SECURITY REGRESSION: checksrc errors and failing test case for
CVE-2026-8927 (LP #2167779)
- debian/patches/CVE-2026-6429.patch: Fix indentation to fix
autopkgtests in lib/transfer.c.
- debian/patches/CVE-2026-8286.patch: Wrap long line to fix
autopkgtests in lib/url.c.
- debian/patches/CVE-2026-8458.patch: Wrap long lines and fix
indentation to fix autopkgtests in lib/curl_sasl.c.
- debian/patches/CVE-2026-8927.patch: Fix failing test
-- Charles Cochran Fri, 18 Sep 2026 11:45:57 -0400
|
| Source diff to previous version |
| 2167779 |
Reverted security upload 8.20.0-2ubuntu4, broken checksrc and CVE-2026-8927 backport |
| CVE-2026-13608 |
A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptogra |
| CVE-2026-18924 |
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-af |
| CVE-2026-80230 |
When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL |
| CVE-2026-82209 |
When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domai |
| CVE-2026-8927 |
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentic |
| CVE-2026-6429 |
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the f |
| CVE-2026-8286 |
A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS |
| CVE-2026-8458 |
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different |
|
|
curl (8.5.0-2ubuntu10.11) noble-security; urgency=medium
* SECURITY UPDATE: Use after free in curl_easy_reset.
- debian/patches/CVE-2026-10536.patch: Deprecate CURLOPT_STREAM_DEPENDS
and CURLOPT_STREAM_DEPENDS_E and remove stream dependency tracking in
include/curl/curl.h, lib/http2.c, ../setopt.c, ../url.c, and
../urldata.h
- CVE-2026-10536
* debian/patches/CVE-2026-5773.patch: Fix potential edge cases in fix. Thanks to Siddharth Doshi.
-- Kyle Kernick <email address hidden> Mon, 06 Jul 2026 11:02:02 -0600
|
| Source diff to previous version |
| CVE-2026-10536 |
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CUR |
| CVE-2026-5773 |
libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequen |
|
|
curl (8.5.0-2ubuntu10.10) noble-security; urgency=medium
* SECURITY UPDATE: Connection reuse for starttls protocols.
- debian/patches/CVE-2026-8286.patch: When a connection is tested for
reuse in a transfer that may upgrade to TLS (commonly via STARTTLS),
the SSL configuration must match the existing connection in lib/url.c
- CVE-2026-8286
* SECURITY UPDATE: Connection reuse in SASL.
- debian/patches/CVE-2026-8458.patch: Fix erroneous connection reuse in
in lib/curl_sasl.c, lib/http_negotiate.c, lib/http_ntlm.c, lib/imap.c,
lib/openldap.c, and lib/pop3.c
- CVE-2026-8458
* SECURITY UPDATE: Cookie injection in is_public_suffix.
- debian/patches/CVE-2026-8924.patch: Trim trailing dots when checking
PSL in lib/cookie.c.
- CVE-2026-8924
* SECURITY UPDATE: Double-free in gsasl.
- debian/patches/CVE-2026-8925.patch: Require libgasl 1.6.0 to handle
NULL argument in lib/vauth/gsasl.c.
- CVE-2026-8925
* SECURITY UPDATE: Information disclosure in libcurl
- debian/patches/CVE-2026-8927.patch: Detect if proxy is not the same as
previous and flush state in lib/url.c and lib/urldata.h.
- CVE-2026-8927
* SECURITY UPDATE: Man-in-the-middle in libcurl.
- debian/patches/CVE-2026-9547.patch: Reject host key mismatches in
in lib/vssh/libssh.c
- CVE-2026-9547
-- Kyle Kernick <email address hidden> Mon, 29 Jun 2026 10:22:57 -0600
|
About
-
Send Feedback to @ubuntu_updates
