diff -Nru falconpl-0.9.6.9-git20120606/debian/changelog falconpl-0.9.6.9-git20120606/debian/changelog --- falconpl-0.9.6.9-git20120606/debian/changelog 2012-06-14 22:18:32.000000000 +0530 +++ falconpl-0.9.6.9-git20120606/debian/changelog 2012-12-26 11:13:56.000000000 +0530 @@ -1,3 +1,11 @@ +falconpl (0.9.6.9-git20120606-2) unstable; urgency=medium + + * debian/patches/02-Fixed-the-value-set-for-CURLOPT_SSL_VERIFYHOST.patch: + + Added patch to fix possible security issue due to misuse of the libcurl + API. Patch has been accepted upstream and discussed. (Closes: #696681) + + -- Kartik Mistry Wed, 26 Dec 2012 11:12:33 +0530 + falconpl (0.9.6.9-git20120606-1) unstable; urgency=low [Kartik Mistry] diff -Nru falconpl-0.9.6.9-git20120606/debian/patches/02-Fixed-the-value-set-for-CURLOPT_SSL_VERIFYHOST.patch falconpl-0.9.6.9-git20120606/debian/patches/02-Fixed-the-value-set-for-CURLOPT_SSL_VERIFYHOST.patch --- falconpl-0.9.6.9-git20120606/debian/patches/02-Fixed-the-value-set-for-CURLOPT_SSL_VERIFYHOST.patch 1970-01-01 05:30:00.000000000 +0530 +++ falconpl-0.9.6.9-git20120606/debian/patches/02-Fixed-the-value-set-for-CURLOPT_SSL_VERIFYHOST.patch 2012-12-26 12:55:48.000000000 +0530 @@ -0,0 +1,31 @@ +Description: Fixed the value set for CURLOPT_SSL_VERIFYHOST +The valid value for CURLOPT_SSL_VERIFYHOST is either 0 or 2 but code was +setting it to 1 which is wrong and will return a failure from libcurl 7.8.1 +Author: Vasudev Kamath +Last-Update: 2012-11-30 +Forwarded: https://groups.google.com/forum/?fromgroups=#!msg/falconpl/Vnnv0yb-_Bg/Vkl5RFHEk8QJ + +--- a/modules/native/curl/src/curl_ext.cpp ++++ b/modules/native/curl/src/curl_ext.cpp +@@ -525,15 +525,18 @@ static void internal_setOpt( VMachine* vm, Mod::CurlHandle* h, CURLoption iOpt, + #if LIBCURL_VERSION_NUM >= 0x071901 + case CURLOPT_CERTINFO: + #endif +- case CURLOPT_SSL_VERIFYHOST: + case CURLOPT_SSL_SESSIONID_CACHE: + { + long bVal = i_data->isTrue() ? 1 : 0; + ret = curl_easy_setopt( curl, iOpt, bVal ); + } + break; +- +- ++ case CURLOPT_SSL_VERIFYHOST: ++ { ++ long bVal = i_data->isTrue() ? 2 : 0; ++ ret = curl_easy_setopt( curl, iOpt, bVal ); ++ } ++ break; + #ifdef CURLOPT_PROTOCOLS + case CURLOPT_PROTOCOLS: + case CURLOPT_REDIR_PROTOCOLS: diff -Nru falconpl-0.9.6.9-git20120606/debian/patches/series falconpl-0.9.6.9-git20120606/debian/patches/series --- falconpl-0.9.6.9-git20120606/debian/patches/series 2012-06-14 07:57:31.000000000 +0530 +++ falconpl-0.9.6.9-git20120606/debian/patches/series 2012-12-26 11:08:36.000000000 +0530 @@ -1 +1,2 @@ 01_gtk_MessageDialog_Wformat-security.patch +02-Fixed-the-value-set-for-CURLOPT_SSL_VERIFYHOST.patch