CVSROOT: /cvs
Module name: ports
Changes by: [email protected] 2016/11/04 09:20:53
Modified files:
net/curl : Tag: OPENBSD_5_9 Makefile distinfo
net/curl/pkg : Tag: OPENBSD_5_9 PLIST
Removed files:
net/curl/patches: Tag: OPENBSD_5_9
patch-docs_examples_getredirect_c
patch-lib_escape_c patch-lib_multi_c
patch-lib_url_c patch-lib_urldata_h
patch-lib_vtls_vtls_c
Log message:
Security update to 7.51.0.
CVE-2016-8615: cookie injection for other servers
CVE-2016-8616: case insensitive password comparison
CVE-2016-8617: OOB write via unchecked multiplication
CVE-2016-8618: double-free in curl_maprintf
CVE-2016-8619: double-free in krb5 code
CVE-2016-8620: glob parser write/read out of bounds
CVE-2016-8621: curl_getdate read out of bounds
CVE-2016-8622: URL unescape heap overflow via integer truncation
CVE-2016-8623: Use-after-free via shared cookies
CVE-2016-8624: invalid URL parsing with '#'
CVE-2016-8625: IDNA 2003 makes curl use wrong host
Note that this drops support for internationalized domain names.
