cURL 7.24.0.20120225

Log in or click on link to see number of positives.

• curl.7.24.0.20120225.nupkg (c8e7fd39d450) - ## / 57
• curl.exe (78c17fb84e49) - ## / 46
• libcurl.dll (273e2f9f9059) - ## / 46
• libeay32.dll (55d5a62095c2) - ## / 57
• libssl32.dll (df249f8b5858) - ## / 57

This release includes the following security fixes:

o curl was vulnerable to a data injection attack for certain protocols
http://curl.haxx.se/docs/adv_20120124.html
o curl was vulnerable to a SSL CBC IV vulnerability when built to use OpenSSL
http://curl.haxx.se/docs/adv_20120124B.html

This release includes the following changes:

o CURLOPT_QUOTE: SFTP supports the '*'-prefix now [24]
o CURLOPT_DNS_SERVERS: set name servers if possible [23]
o Add support for using nettle instead of gcrypt as gnutls backend [22]
o CURLOPT_INTERFACE: avoid resolving interfaces names with magic prefixes [21]
o Added CURLOPT_ACCEPTTIMEOUT_MS [30]
o configure: add symbols versioning option --enable-versioned-symbols [31]

This release includes the following bugfixes:

o SSL session share: move the age counter to the share object [1]
o -J -O: use -O name if no Content-Disposition header comes! [2]
o protocol_connect: show verbose connect and set connect time [3]
o query-part: ignore the URI part for given protocols [4]
o gnutls: only translate winsock errors for old versions [5]
o POP3: fix end of body detection [6]
o POP3: detect when LIST returns no mails
o TELNET: improved treatment of options [7]
o configure: add support for pkg-config detection of libidn [8]
o CyaSSL 2.0+ library initialization adjustment [9]
o multi interface: only use non-NULL socker function pointer
o call opensocket callback properly for active FTP
o don't call close socket callback for sockets created with accept() [10]
o differentiate better between host/proxy errors [11]
o SSH: fix CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 and --hostpubmd5 [12]
o multi: handle timeouts on DNS servers by checking for new sockets [13]
o CURLOPT_DNS_SERVERS: fix return code
o POP3: fixed escaped dot not being stripped out [14]
o OpenSSL: check for the SSLv2 function in configure [15]
o MakefileBuild: fix the static build [16]
o create_conn: don't switch to HTTP protocol if tunneling is enabled [17]
o multi interface: fix block when CONNECT_ONLY option is used [18]
o Fix connection reuse for TLS upgraded connections [19]
o multiple file upload with -F and custom type [20]
o multi interface: active FTP connections are no longer blocking [25]
o Android build fix [26]
o timer: restore PRETRANSFER timing [27]
o libcurl.m4: Fix quoting arguments of AC_LANG_PROGRAM [28]
o appconnect time fixed for non-blocking connect ssl backends [29]
o do not include SSL handshake into time spent waiting for 100-continue [32]
o handle dns cache case insensitive
o use new host name casing for subsequent HTTP requests [33]
o CURLOPT_RESOLVE: avoid adding already present host names
o SFTP mkdir: use correct permission [34]
o resolve: don't leak pre-populated dns entries [35]
o --retry: Retry transfers on timeout and DNS errors
o negotiate with SSPI backend: use the correct buffer for input [36]
o SFTP dir: increase buffer size counter to avoid cut off file names [37]
o TFTP: fix resending (again) [38]
o c-ares: don't include getaddrinfo-using code [39]
o FTP: CURLE_PARTIAL_FILE will not close the control channel [40]
o win32-threaded-resolver: stop using a dummy socket
o OpenSSL: remove reference to openssl internal struct [41]
o OpenSSL: SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option no longer enabled
o OpenSSL: fix PKCS#12 certificate parsing related memory leak
o OpenLDAP: fix LDAP connection phase memory leak [42]
o Telnet: Use correct file descriptor for telnet upload
o Telnet: Remove bogus optimisation of telnet upload
o URL parse: user name with ipv6 numerical address
o polarssl: show cipher suite name correctly with 1.1.0
o polarssl: havege_rand is not present in version 1.1.0 WARNING, we still
use the old API which is said to be insecure. See
http://polarssl.org/trac/wiki/SecurityAdvisory201102
o gnutls: enforced use of SSLv3 [43]

This package has no dependencies.