From 969ec949a8ec1b19009b0915582b359de2ec1d2a Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Mon, 1 Feb 2016 22:37:05 +0000 Subject: [PATCH] curl: update curl to version 7.47.0 This fixes the following security problems: CVE-2016-0754: remote file name path traversal in curl tool for Windows http://curl.haxx.se/docs/adv_20160127A.html CVE-2016-0755: NTLM credentials not-checked for proxy connection re-use http://curl.haxx.se/docs/adv_20160127B.html Signed-off-by: Hauke Mehrtens SVN-Revision: 48614 --- package/network/utils/curl/Makefile | 6 +++--- .../network/utils/curl/patches/200-no_docs_tests.patch | 8 ++++---- .../utils/curl/patches/300-fix-disable-crypto-auth.patch | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/package/network/utils/curl/Makefile b/package/network/utils/curl/Makefile index 82574cd396..56dcb6b60d 100644 --- a/package/network/utils/curl/Makefile +++ b/package/network/utils/curl/Makefile @@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=curl -PKG_VERSION:=7.43.0 +PKG_VERSION:=7.47.0 PKG_RELEASE:=1 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 @@ -18,7 +18,7 @@ PKG_SOURCE_URL:=http://curl.haxx.se/download/ \ ftp://ftp.planetmirror.com/pub/curl/ \ http://www.mirrormonster.com/curl/download/ \ http://curl.mirrors.cyberservers.net/download/ -PKG_MD5SUM:=11bddbb452a8b766b932f859aaeeed39 +PKG_MD5SUM:=85c58a00412476993050cb242a3f365d PKG_LICENSE:=MIT PKG_LICENSE_FILES:=COPYING @@ -114,7 +114,7 @@ CONFIGURE_ARGS += \ \ $(if $(CONFIG_LIBCURL_AXTLS),--with-axtls="$(STAGING_DIR)/usr" --without-ca-path,--without-axtls) \ $(if $(CONFIG_LIBCURL_CYASSL),--with-cyassl="$(STAGING_DIR)/usr" --without-ca-path,--without-cyassl) \ - $(if $(CONFIG_LIBCURL_GNUTLS),--with-gnutls="$(STAGING_DIR)/usr" --without-ca-path,--without-gnutls) \ + $(if $(CONFIG_LIBCURL_GNUTLS),--with-gnutls="$(STAGING_DIR)/usr" --with-ca-path=/etc/ssl/certs,--without-gnutls) \ $(if $(CONFIG_LIBCURL_OPENSSL),--with-ssl="$(STAGING_DIR)/usr" --with-ca-path=/etc/ssl/certs,--without-ssl) \ $(if $(CONFIG_LIBCURL_POLARSSL),--with-polarssl="$(STAGING_DIR)/usr" --with-ca-path=/etc/ssl/certs,--without-polarssl) \ \ diff --git a/package/network/utils/curl/patches/200-no_docs_tests.patch b/package/network/utils/curl/patches/200-no_docs_tests.patch index 2845577f1c..5db39258d0 100644 --- a/package/network/utils/curl/patches/200-no_docs_tests.patch +++ b/package/network/utils/curl/patches/200-no_docs_tests.patch @@ -1,9 +1,9 @@ --- a/Makefile.am +++ b/Makefile.am -@@ -129,7 +129,7 @@ CLEANFILES = $(VC6_LIBDSP) $(VC6_SRCDSP) +@@ -141,7 +141,7 @@ CLEANFILES = $(VC6_LIBDSP) $(VC6_SRCDSP) bin_SCRIPTS = curl-config - SUBDIRS = lib src include + SUBDIRS = lib src include scripts -DIST_SUBDIRS = $(SUBDIRS) tests packages docs +DIST_SUBDIRS = $(SUBDIRS) packages @@ -11,10 +11,10 @@ pkgconfig_DATA = libcurl.pc --- a/Makefile.in +++ b/Makefile.in -@@ -577,7 +577,7 @@ CLEANFILES = $(VC6_LIBDSP) $(VC6_SRCDSP) +@@ -601,7 +601,7 @@ CLEANFILES = $(VC6_LIBDSP) $(VC6_SRCDSP) bin_SCRIPTS = curl-config - SUBDIRS = lib src include + SUBDIRS = lib src include scripts -DIST_SUBDIRS = $(SUBDIRS) tests packages docs +DIST_SUBDIRS = $(SUBDIRS) packages pkgconfigdir = $(libdir)/pkgconfig diff --git a/package/network/utils/curl/patches/300-fix-disable-crypto-auth.patch b/package/network/utils/curl/patches/300-fix-disable-crypto-auth.patch index 1cdb8200e1..abec7ad912 100644 --- a/package/network/utils/curl/patches/300-fix-disable-crypto-auth.patch +++ b/package/network/utils/curl/patches/300-fix-disable-crypto-auth.patch @@ -11,7 +11,7 @@ unsigned char ntbuffer[0x18]; --- a/lib/vtls/vtls.c +++ b/lib/vtls/vtls.c -@@ -852,9 +852,9 @@ CURLcode Curl_ssl_md5sum(unsigned char * +@@ -921,9 +921,9 @@ CURLcode Curl_ssl_md5sum(unsigned char * unsigned char *md5sum, /* output */ size_t md5len) { -- 2.30.2