[ubuntu/resolute-security] curl 8.18.0-1ubuntu2.3 (Accepted)

[Kyle Kernick]

curl (8.18.0-1ubuntu2.3) resolute-security; urgency=medium

  * SECURITY UPDATE: Use after free in curl_easy_reset.
    - debian/patches/CVE-2026-10536.patch: Deprecate CURLOPT_* in
      include/curl/curl.h, lib/http2.c,
      lib/setopt.c, lib/url.c, and lib/urldata.h
    - CVE-2026-10536
  * SECURITY UPDATE: Denial of service in QUIC UDP.
    - debian/patches/CVE-2026-11352.patch: Count zero-length UDP packets
      and enforce an upper bound in
      lib/vquic/vquic.c
    - CVE-2026-11352
  * SECURITY UPDATE: Improper certificate validation in native_ca_store.
    - debian/patches/CVE-2026-11564.patch: Add bit native_ca_store_opt to
      keep the setting of CURLOPT_(PROXY_)SSL_OPTIONS and use that to
      calculate every easy transfer if a native CA store shall be used or
      not in lib/doh.c, lib/setopt.c, and lib/vtls/vtls.c
    - CVE-2026-11564
  * SECURITY UPDATE: Memory exhaustion in ws.c
    - debian/patches/CVE-2026-11586.patch: Do not send PONG frames unless
      there is sufficient space left in the websocket send buffer in
      lib/ws.c.
    - CVE-2026-11586
  * SECURITY UPDATE: Improper validation in config2setopts.
    - debian/patches/CVE-2026-12064.patch: Use default protocol properly in
      src/config2setopts.c.
    - CVE-2026-12064

Date: 2026-07-07 16:03:12.781004+00:00
Changed-By: Kyle Kernick <kyle.kernick at canonical.com>
https://launchpad.net/ubuntu/+source/curl/8.18.0-1ubuntu2.3
-------------- next part --------------
Sorry, changesfile not available.