openembedded-core.git/meta/recipes-support/curl, branch fido

curl: Secuirty fix CVE-2016-0755

2016-02-29T15:05:16+00:00

CVE-2016-0755 curl: NTLM credentials not-checked for proxy connection re-use

(From OE-Core master rev: 8322814c7f657f572d5c986652e708d6bd774378)

hand applied changed to url.c

Signed-off-by: Armin Kuster 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 
Signed-off-by: Joshua Lock

curl: Security fix CVE-2016-0754

2016-02-29T15:05:16+00:00

CVE-2016-0754 curl: remote file name path traversal in curl tool for Windows

(From OE-Core master rev: b2c9b48dea2fd968c307a809ff95f2e686435222)

minor tweak to tool_operate.c to get it to apply

Signed-off-by: Armin Kuster 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 
Signed-off-by: Joshua Lock

curl: Fix wrong assumption about sizeof off_t on largefile systems

2015-06-28T08:41:52+00:00

This issue was reported on poky ml as well see
https://lists.yoctoproject.org/pipermail/poky/2013-December/009435.html

Change-Id: Iedf22467889893111fde0433e411fd0546a38546
(From OE-Core rev: 3c58712465494e441c4036a7cf21d2e6d343efab)

Signed-off-by: Khem Raj 
Signed-off-by: Richard Purdie

curl: several security fixes

2015-04-27T14:25:19+00:00

Fixes below listed bugs:
1. CVE-2015-3143
2. CVE-2015-3144
3. CVE-2015-3145
4. CVE-2015-3148

Signed-off-by: Maxin B. John 
Signed-off-by: Richard Purdie

curl: remove samba from PACKAGECONFIG[smb] DEPENDS

2015-03-16T17:38:50+00:00

Enabling support for the smb protocol does not create
a build time dependency on samba.

Signed-off-by: Andre McCurdy 
Signed-off-by: Ross Burton

curl: Add PACKAGECONFIG for samba

2015-01-23T11:35:24+00:00

curl 7.40.0 added support for the SMB/CIFS protocol. So provide
a PACKAGECONFIG option for smb.

Reported-by: Andre McCurdy 
Signed-off-by: Maxin B. John 
Signed-off-by: Ross Burton

curl: upgrade to 7.40

2015-01-16T22:59:45+00:00

Bump to version 7.40

Signed-off-by: Maxin B. John 
Signed-off-by: Ross Burton

curl: Ugrade to 7.38

2014-12-03T12:22:39+00:00

Remove backported CVE patches

Signed-off-by: Saul Wold

curl: Security Advisory - curl - CVE-2014-3620

2014-11-05T16:49:31+00:00

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs), thus
making them apply broader than cookies are allowed. This can allow arbitrary
sites to set cookies that then would get sent to a different and unrelated site
or domain.

Signed-off-by: Chong Lu

curl: Security Advisory - curl - CVE-2014-3613

2014-11-04T10:19:56+00:00

By not detecting and rejecting domain names for partial literal IP addresses
properly when parsing received HTTP cookies, libcurl can be fooled to both
sending cookies to wrong sites and into allowing arbitrary sites to set cookies
for others.

Signed-off-by: Chong Lu