Hello community,
here is the log from the commit of package curl.1813 for openSUSE:12.2:Update checked in at 2013-07-03 16:10:06
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:12.2:Update/curl.1813 (Old)
and /work/SRC/openSUSE:12.2:Update/.curl.1813.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "curl.1813"
Changes:
--------
New Changes file:
--- /dev/null 2013-07-02 09:26:14.908030755 +0200
+++ /work/SRC/openSUSE:12.2:Update/.curl.1813.new/curl.changes 2013-07-03 16:10:08.000000000 +0200
@@ -0,0 +1,1016 @@
+-------------------------------------------------------------------
+Thu Jun 13 10:06:23 UTC 2013 - vcizek@suse.com
+
+- fix for CVE-2013-2174 (bnc#824517)
+ added curl-CVE-2013-2174.patch
+
+-------------------------------------------------------------------
+Fri Apr 12 11:01:51 UTC 2013 - vcizek@suse.com
+
+- fixed CVE-2013-1944 (bnc#814655)
+ added curl-CVE-2013-1944.patch
+
+-------------------------------------------------------------------
+Sat May 12 23:24:56 UTC 2012 - jengelh@inai.de
+
+- Update to new upstream release 7.25.0
+* Added CURLOPT_TCP_KEEPALIVE, CURLOPT_TCP_KEEPIDLE,
+ CURLOPT_TCP_KEEPINTVL
+* use new library-side TCP_KEEPALIVE options
+* Added a new CURLOPT_MAIL_AUTH option
+* Added support for --mail-auth
+* (for more see the shipped CHANGES file)
+
+-------------------------------------------------------------------
+Wed Feb 8 00:45:18 UTC 2012 - crrodriguez@opensuse.org
+
+- Problem with the c-ares backend, workaround for [bnc#745534]
+
+-------------------------------------------------------------------
+Thu Feb 2 18:47:10 UTC 2012 - crrodriguez@opensuse.org
+
+- Update to version curl 7.24.0
+- refresh patches to fix broken build
+
+-------------------------------------------------------------------
+Wed Jan 18 13:49:56 CET 2012 - dmueller@suse.de
+
+- use the rpmoptflags unconditionally, don't do own compiler flag
+ magic. Fixes debuginfo package built
+
+-------------------------------------------------------------------
+Wed Dec 28 10:30:28 UTC 2011 - mmarek@suse.cz
+
+- Package /usr/share/aclocal to avoid build dependency on automake.
+
+-------------------------------------------------------------------
+Wed Nov 30 22:39:35 UTC 2011 - crrodriguez@opensuse.org
+
+- Use O_CLOEXEC in library code.
+
+-------------------------------------------------------------------
+Tue Nov 29 11:51:38 UTC 2011 - jengelh@medozas.de
+
+- Remove redundant/unwanted tags/section (cf. specfile guidelines)
+
+-------------------------------------------------------------------
+Tue Nov 29 08:20:23 UTC 2011 - idoenmez@suse.de
+
+- Use original source tarball
+
+-------------------------------------------------------------------
+Mon Nov 28 12:00:00 UTC 2011 - opensuse@dstoecker.de
+
+- Update to version 7.23.1:
+ + Empty headers can be sent in HTTP requests by terminating with a semicolon
+ + SSL session sharing support added to curl_share_setopt()
+ + Added support to MAIL FROM for the optional SIZE parameter
+ + smtp: Added support for NTLM authentication
+ + curl tool: code split into tool_*.[ch] files
+ + lots of bugfixes
+-------------------------------------------------------------------
+Mon Oct 3 15:44:17 UTC 2011 - dimstar@opensuse.org
+
+- Update to version 7.22.0:
+ + Added CURLOPT_GSSAPI_DELEGATION
+ + Added support for NTLM delegation to Samba's winbind daemon
+ helper ntlm_auth
+ + Display notes from setup file in testcurl.pl
+ + BSD-style lwIP TCP/IP stack experimental support on Windows
+ + OpenSSL: Use SSL_MODE_RELEASE_BUFFERS if available
+ + --delegation was added to set CURLOPT_GSSAPI_DELEGATION
+ + nss: start with no database if the selected database is broken
+ + telnet: allow programatic use on Windows
+ + for a list of bugfixes, see
+ http://curl.haxx.se/changes.html#7_22_0
+- Drop curl-openssl-release-buffers.patch: fixed upstream.
+- Add curl-fix-m4.patch: Use 'x' in configure scripts. Fixes issues
+ when configure is run with -Werror -Wall.
+
+-------------------------------------------------------------------
+Sun Sep 18 00:10:42 UTC 2011 - jengelh@medozas.de
+
+- Remove redundant tags/sections from specfile
+- Use %_smp_mflags for parallel build
+
+-------------------------------------------------------------------
+Fri Sep 16 17:22:44 UTC 2011 - jengelh@medozas.de
+
+- Add curl-devel to baselibs
+
+-------------------------------------------------------------------
+Mon Aug 15 05:05:01 UTC 2011 - crrodriguez@opensuse.org
+
+- Use SSL_MODE_RELEASE_BUFFERS if available, accepted
+ in upstream as commit 3d919440c80333c496fb
+
+-------------------------------------------------------------------
+Tue Jul 12 06:46:02 UTC 2011 - coolo@novell.com
+
+- remove support for old suse_versions
+
+-------------------------------------------------------------------
+Mon Jul 11 11:40:17 CEST 2011 - pth@suse.de
+
+- Update to 7.21.7:
+ - Fix libcurl inappropriate GSSAPI delegation. Full details at
+ http://curl.haxx.se/docs/adv_20110623.html
+ - Some other minor fixes.
+
+- Use the lzma compressed tarball provided upstreams.
+
+-------------------------------------------------------------------
+Fri May 20 16:25:34 UTC 2011 - crrodriguez@opensuse.org
+
+- remove unintented LDFLAGS from the spec file
+
+-------------------------------------------------------------------
+Fri May 20 15:37:54 UTC 2011 - crrodriguez@opensuse.org
+
+- Update to 7.21.6
+* curl-config: fix --version
+* use HTTPS properly after CONNECT
+* SFTP: close file before post quote operations
+
+-------------------------------------------------------------------
+Thu Apr 14 17:02:19 UTC 2011 - crrodriguez@opensuse.org
+
+- bnc#598574 has been fixed in upstream commit 8ab137b2bc9630ce20f4
+ already, so enable c-ares support again.
+
+-------------------------------------------------------------------
+Sat Apr 9 20:42:27 UTC 2011 - crrodriguez@opensuse.org
+
+- Support openSSL compiled without SSLv2 support
+- Update to version 7.21.4
+ * SMTP: add brackets for MAIL FROM
+ * multi: connect fail => use next IP address
+ * pubkey_show: allocate buffer to fit any-size result
+ * Curl_do: avoid using stale conn pointer
+ * tftpd test server: avoid buffer overflow report from glibc
+ * OpenSSL get_cert_chain: support larger data sets
+ * SCP/SFTP transfers: acknowledge speedcheck
+ * connect problem: use UDP correctly
+ * OpenSSL: improved error message on SSL_CTX_new failures
+ * HTTP: memory leak on multiple Location:
+ * curl.1: typo in -v description
+ * CURLOPT_SOCKOPTFUNCTION: return proper error code --keepalive-time
+ * file: add support for CURLOPT_TIMECONDITION
+ * multi: fix CURLM_STATE_TOOFAST for multi_socket
+-------------------------------------------------------------------
+Fri Oct 22 16:37:03 UTC 2010 - cristian.rodriguez@opensuse.org
+
+- Update to version 7.21.2
+ * curl -T: ignore file size of special files
+ * Added GOPHER protocol support
+ * Added mk-ca-bundle.vbs script
+ * c-ares build now requires c-ares >= 1.6.0
+ * --remote-header-name security vulnerability fixed
+ * multi: support the timeouts correctly, fixes known bug #62
+ * multi: use timeouts properly for MAX_RECV/SEND_SPEED
+ * negotiation: Wrong proxy authorization
+ * multi: avoid sending multiple complete messages
+ * cmdline: make -F type= accept ;charset=
+ * RESUME_FROM: clarify what ftp uploads do
+ * http: handle trailer headers in all chunked responses
+ * Curl_is_connected: use correct errno
+ * progress: callback for POSTs less than MAX_INITIAL_POST_SIZE
+ * Link curl and the test apps with -lrt explicitly when necessary
+ * chunky parser: only rewind stream internally if needed
+ * remote-header-name: don't output filename when NULL
+ * Curl_timeleft: avoid returning "no timeout" by mistake
+ * timeout: use the correct start value as offset
+ * FTP: fix wrong timeout trigger
+ * rtsp: avoid SIGSEGV on malformed header
+ * LDAP: Support for tunnelling queries through HTTP proxy
+ * curl_easy_duphandle: clone the c-ares handle correctly
+ * support URL containing colon without trailing port number
+ * parsedate: allow time specified without seconds
+ * curl_easy_escape: don't escape "unreserved" characters
+ * SFTP: avoid downloading negative sizes
+ * Lots of GSS/KRB FTP fixes
+ * TFTP: Work around tftpd-hpa upload bug
+ * libcurl.m4: several fixes
+ * HTTP: remove special case for 416
+ * globbing: fix crash on unballanced open brace
+
+-------------------------------------------------------------------
++++ 819 more lines (skipped)
++++ between /dev/null
++++ and /work/SRC/openSUSE:12.2:Update/.curl.1813.new/curl.changes
New:
----
baselibs.conf
curl-7.25.0.tar.lzma
curl-7.25.0.tar.lzma.asc
curl-CVE-2013-1944.patch
curl-CVE-2013-2174.patch
curl.changes
curl.spec
dont-mess-with-rpmoptflags.diff
libcurl-ocloexec.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ curl.spec ++++++
#
# spec file for package curl
#
# Copyright (c) 2013 SUSE LINUX Products GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via http://bugs.opensuse.org/
#
%bcond_without openssl
%bcond_with mozilla_nss
%bcond_without testsuite
Name: curl
Version: 7.25.0
Release: 0
Summary: A Tool for Transferring Data from URLs
License: BSD-3-Clause and MIT
Group: Productivity/Networking/Web/Utilities
Url: http://curl.haxx.se/
Source: http://curl.haxx.se/download/%{name}-%{version}.tar.lzma
Source2: http://curl.haxx.se/download/%{name}-%{version}.tar.lzma.asc
Source3: baselibs.conf
Patch: libcurl-ocloexec.patch
Patch1: dont-mess-with-rpmoptflags.diff
Patch3: curl-CVE-2013-1944.patch
Patch4: curl-CVE-2013-2174.patch
BuildRequires: libidn-devel
BuildRequires: libtool
BuildRequires: lzma
BuildRequires: openldap2-devel
BuildRequires: pkg-config
BuildRequires: zlib-devel
%if %{with openssl}
BuildRequires: openssl-devel
%endif
%if %{with mozilla_nss}
BuildRequires: mozilla-nss-devel
%endif
BuildRequires: krb5-devel
BuildRequires: libcares-devel
BuildRequires: libssh2-devel
BuildRequires: openssh
%if 0%{?_with_stunnel:1}
# used by the testsuite
BuildRequires: stunnel
%endif
BuildRoot: %{_tmppath}/%{name}-%{version}-build
# bug437293
%ifarch ppc64
Obsoletes: curl-64bit
%endif
%description
Curl is a client to get documents and files from or send documents to a
server using any of the supported protocols (HTTP, HTTPS, FTP, FTPS,
TFTP, DICT, TELNET, LDAP, or FILE). The command is designed to work
without user interaction or any kind of interactivity.
%package -n libcurl4
Summary: Version 4 of cURL shared library
Group: Productivity/Networking/Web/Utilities
%description -n libcurl4
The cURL shared library version 4 for accessing data using different
network protocols.
%package -n libcurl-devel
Summary: A Tool for Transferring Data from URLs
Group: Development/Libraries/C and C++
Requires: glibc-devel
Requires: libcurl4 = %{version}
# curl-devel (v 7.15.5) was last used in 10.2
Provides: curl-devel <= 7.15.5
Obsoletes: curl-devel < 7.16.2
%description -n libcurl-devel
Curl is a client to get documents and files from or send documents to a
server using any of the supported protocols (HTTP, HTTPS, FTP, GOPHER,
DICT, TELNET, LDAP, or FILE). The command is designed to work without
user interaction or any kind of interactivity.
%prep
%setup -q
%patch
%patch1
%patch3 -p1
%patch4 -p1
%build
autoreconf -fi
# local hack to make curl-config --libs stop printing libraries it depends on
# (currently, libtool sets link_all_deplibs=(yes|unknown) everywhere,
# will hopefully change in the future)
sed -i 's/link_all_deplibs=unknown/link_all_deplibs=no/' configure
%configure \
--enable-ipv6 \
%if %{with openssl}
--with-ssl \
--with-ca-path=/etc/ssl/certs/ \
%else
--without-ssl \
%if %{with mozilla_nss}
--with-nss \
%endif
%endif
--with-gssapi=/usr/lib/mit \
--with-libssh2\
--enable-hidden-symbols \
--disable-static \
--enable-threaded-resolver
: if this fails, the above sed hack did not work
./libtool --config | grep -q link_all_deplibs=no
# enable-hidden-symbols needs gcc4 and causes that curl exports only its API
make %{?_smp_mflags}
%if %{with testsuite}
%check
cd tests
make
# make sure the testsuite runs don't race on MP machines in autobuild
if test -z "$BUILD_INCARNATION" -a -r /.buildenv; then
. /.buildenv
fi
if test -z "$BUILD_INCARNATION"; then
BUILD_INCARNATION=0
fi
base=$((8990 + $BUILD_INCARNATION * 20))
perl ./runtests.pl -a -b$base || {
%if 0%{?curl_testsuite_fatal:1}
exit
%else
echo "WARNING: runtests.pl failed with code $?, continuing nevertheless"
%endif
}
%endif
%install
%{makeinstall}
rm $RPM_BUILD_ROOT%_libdir/libcurl.la
install -d $RPM_BUILD_ROOT/usr/share/aclocal
install -m 644 docs/libcurl/libcurl.m4 $RPM_BUILD_ROOT/usr/share/aclocal/
%post -n libcurl4 -p /sbin/ldconfig
%postun -n libcurl4 -p /sbin/ldconfig
%files
%defattr(-,root,root)
%doc README RELEASE-NOTES
%doc docs/{BUGS,FAQ,FEATURES,MANUAL,RESOURCES,TODO,TheArtOfHttpScripting}
%doc lib/README.curl_off_t
%{_prefix}/bin/curl
%doc %{_mandir}/man1/curl.1.gz
%files -n libcurl4
%defattr(-,root,root)
%{_libdir}/libcurl.so.4*
%files -n libcurl-devel
%defattr(-,root,root)
%{_prefix}/bin/curl-config
%{_prefix}/include/curl
%dir %{_prefix}/share/aclocal
%{_prefix}/share/aclocal/libcurl.m4
%{_libdir}/libcurl.so
%{_libdir}/pkgconfig/libcurl.pc
%doc %{_mandir}/man1/curl-config.1.gz
%doc %{_mandir}/man3/*
%doc docs/libcurl/symbols-in-versions
%changelog
++++++ baselibs.conf ++++++
libcurl4
obsoletes "curl-<targettype> <= <version>"
provides "curl-<targettype> = <version>"
curl-devel
requires -curl-<targettype>
requires "libcurl4-<targettype> = <version>"
++++++ curl-CVE-2013-1944.patch ++++++
Index: curl-7.25.0/lib/cookie.c
===================================================================
--- curl-7.25.0.orig/lib/cookie.c 2013-04-15 16:29:09.522392557 +0200
+++ curl-7.25.0/lib/cookie.c 2013-04-15 16:29:09.557393639 +0200
@@ -118,15 +118,29 @@ static void freecookie(struct Cookie *co
free(co);
}
-static bool tailmatch(const char *little, const char *bigone)
+static bool tailmatch(const char *cooke_domain, const char *hostname)
{
- size_t littlelen = strlen(little);
- size_t biglen = strlen(bigone);
+ size_t cookie_domain_len = strlen(cooke_domain);
+ size_t hostname_len = strlen(hostname);
- if(littlelen > biglen)
+ if(hostname_len < cookie_domain_len)
return FALSE;
- return Curl_raw_equal(little, bigone+biglen-littlelen) ? TRUE : FALSE;
+ if(!Curl_raw_equal(cooke_domain, hostname+hostname_len-cookie_domain_len))
+ return FALSE;
+
+ /* A lead char of cookie_domain is not '.'.
+ RFC6265 4.1.2.3. The Domain Attribute says:
+ For example, if the value of the Domain attribute is
+ "example.com", the user agent will include the cookie in the Cookie
+ header when making HTTP requests to example.com, www.example.com, and
+ www.corp.example.com.
+ */
+ if(hostname_len == cookie_domain_len)
+ return TRUE;
+ if('.' == *(hostname + hostname_len - cookie_domain_len - 1))
+ return TRUE;
+ return FALSE;
}
/*
Index: curl-7.25.0/tests/data/Makefile.am
===================================================================
--- curl-7.25.0.orig/tests/data/Makefile.am 2012-03-22 08:35:04.000000000 +0100
+++ curl-7.25.0/tests/data/Makefile.am 2013-04-15 16:29:09.557393639 +0200
@@ -78,6 +78,7 @@ test1118 test1119 test1120 test1121 test
test1126 test1127 test1128 test1129 test1130 test1131 \
test1200 test1201 test1202 test1203 test1204 test1205 test1206 test1207 \
test1208 test1209 test1210 test1211 \
+test1218 \
test1220 \
test1300 test1301 test1302 test1303 test1304 test1305 \
test1306 test1307 test1308 test1309 test1310 test1311 test1312 test1313 \
Index: curl-7.25.0/tests/data/test1218
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ curl-7.25.0/tests/data/test1218 2013-04-15 16:29:09.557393639 +0200
@@ -0,0 +1,61 @@
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+HTTP proxy
+cookies
+</keywords>
+</info>
+
+# This test is very similar to 1216, only that it sets the cookies from the
+# first site instead of reading from a file
+<reply>
+<data>
+HTTP/1.1 200 OK
+Date: Tue, 25 Sep 2001 19:37:44 GMT
+Set-Cookie: domain=.example.fake; bug=fixed;
+Content-Length: 21
+
+This server says moo
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+ <name>
+HTTP cookies and domains with same prefix
+ </name>
+ <command>
+http://example.fake/c/1218 http://example.fake/c/1218 http://bexample.fake/c/1218 -b nonexisting -x %HOSTIP:%HTTPPORT
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<strip>
+^User-Agent:.*
+</strip>
+<protocol>
+GET http://example.fake/c/1218 HTTP/1.1
+Host: example.fake
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://example.fake/c/1218 HTTP/1.1
+Host: example.fake
+Accept: */*
+Proxy-Connection: Keep-Alive
+Cookie: bug=fixed
+
+GET http://bexample.fake/c/1218 HTTP/1.1
+Host: bexample.fake
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>
++++++ curl-CVE-2013-2174.patch ++++++
commit 45030219bf8b44270d40fc62e8a02411612d00cc
Author: Daniel Stenberg