touch-packages team mailing list archive

[Launchpad Bug Tracker <1459685@xxxxxxxxxxxxxxxxxx>]

This bug was fixed in the package curl - 7.43.0-1ubuntu1

---------------
curl (7.43.0-1ubuntu1) wily; urgency=medium

  * Merge from Debian. Remaining changes:
    - Drop dependencies not in main:
      + Build-Depends: Drop stunnel4 and libssh2-1-dev.
      + Drop libssh2-1-dev from binary package Depends.

curl (7.43.0-1) unstable; urgency=medium

  * New upstream release
    - Fix lingering HTTP credentials in connection re-use as per CVE-2015-3236
      http://curl.haxx.se/docs/adv_20150617A.html
    - Fix SMB send off unrelated memory contents as per CVE-2015-3237
      http://curl.haxx.se/docs/adv_20150617B.html
  * Refresh patches
  * Fix spelling-error-in-description

 -- Marc Deslauriers <marc.deslauriers@xxxxxxxxxx>  Thu, 18 Jun 2015
07:39:39 -0400

** Changed in: curl (Ubuntu)
       Status: Confirmed => Fix Released

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2015-3236

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2015-3237

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to curl in Ubuntu.
https://bugs.launchpad.net/bugs/1459685

Title:
  please merge curl from debian

Status in curl package in Ubuntu:
  Fix Released

Bug description:
  debdiff attached.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/curl/+bug/1459685/+subscriptions