[ubuntu/questing-security] curl 8.14.1-2ubuntu1.5 (Accepted)

[Kyle Kernick]

curl (8.14.1-2ubuntu1.5) questing-security; urgency=medium

  * SECURITY UPDATE: Use after free in curl_easy_reset.
    - debian/patches/CVE-2026-10536.patch: Deprecate CURLOPT_* in
      include/curl/curl.h, lib/http2.c,
      lib/setopt.c, lib/url.c, and lib/urldata.h
    - CVE-2026-10536
  * SECURITY UPDATE: Improper validation in config2setopts.
    - debian/patches/CVE-2026-12064.patch: Use default protocol properly in
      src/config2setopts.c.
    - CVE-2026-12064
  * debian/patches/CVE-2026-5773.patch: Fix potential edge cases in fix. Thanks to Siddharth Doshi.

Date: 2026-07-07 16:03:24.097635+00:00
Changed-By: Kyle Kernick <kyle.kernick at canonical.com>
https://launchpad.net/ubuntu/+source/curl/8.14.1-2ubuntu1.5
-------------- next part --------------
Sorry, changesfile not available.