curl / Mailing Lists / curl-users / Single Mail

curl-users

[RELEASE] curl 7.57.0

From: Daniel Stenberg <daniel_at_haxx.se>
Date: Wed, 29 Nov 2017 10:33:58 +0100 (CET)

Hi friends!

I'm glad to once again present a brand new curl release. This time we
introduce a few changes and three security advisories. The latter will be
detailed in separate mails sent out in assocation with this.

As always, download the latest curl from https://curl.haxx.se/

Curl and libcurl 7.57.0

  Public curl releases: 171
  Command line options: 211
  curl_easy_setopt() options: 249
  Public functions in libcurl: 74
  Contributors: 1649

This release includes the following changes:

  o auth: add support for RFC7616 - HTTP Digest access authentication [12]
  o share: add support for sharing the connection cache [31]
  o HTTP: implement Brotli content encoding [28]

This release includes the following bugfixes:

  o CVE-2017-8816: NTLM buffer overflow via integer overflow [47]
  o CVE-2017-8817: FTP wildcard out of bounds read [48]
  o CVE-2017-8818: SSL out of buffer access [49]
  o curl_mime_filedata.3: fix typos [1]
  o libtest: Add required test libraries for lib1552 and lib1553 [2]
  o fix time diffs for systems using unsigned time_t [3]
  o ftplistparser: memory leak fix: free temporary memory always [4]
  o multi: allow table handle sizes to be overridden [5]
  o wildcards: don't use with non-supported protocols [6]
  o curl_fnmatch: return error on illegal wildcard pattern [7]
  o transfer: Fix chunked-encoding upload too early exit [8]
  o curl_setup: Improve detection of CURL_WINDOWS_APP [9]
  o resolvers: only include anything if needed [10]
  o setopt: fix CURLOPT_SSH_AUTH_TYPES option read
  o appveyor: add a win32 build
  o Curl_timeleft: change return type to timediff_t [11]
  o cmake: Export libcurl and curl targets to use by other cmake projects [13]
  o curl: in -F option arg, comma is a delimiter for files only [14]
  o curl: improved ";type=" handling in -F option arguments
  o timeval: use mach_absolute_time() on MacOS [15]
  o curlx: the timeval functions are no longer provided as curlx_* [16]
  o mkhelp.pl: do not generate comment with current date [17]
  o memdebug: use send/recv signature for curl_dosend/curl_dorecv [18]
  o cookie: avoid NULL dereference [19]
  o url: fix CURLOPT_POSTFIELDSIZE arg value check to allow -1 [20]
  o include: remove conncache.h inclusion from where its not needed
  o CURLOPT_MAXREDIRS: allow -1 as a value [21]
  o tests: Fixed torture tests on tests 556 and 650
  o http2: Fixed OOM handling in upgrade request
  o url: fix CURLOPT_DNS_CACHE_TIMEOUT arg value check to allow -1
  o CURLOPT_INFILESIZE: accept -1 [22]
  o curl: pass through [] in URLs instead of calling globbing error [23]
  o curl: speed up handling of many URLs [24]
  o ntlm: avoid malloc(0) for zero length passwords [25]
  o url: remove faulty arg value check from CURLOPT_SSH_AUTH_TYPES [26]
  o HTTP: support multiple Content-Encodings [27]
  o travis: add a job with brotli enabled
  o url: remove unncessary NULL-check
  o fnmatch: remove dead code
  o connect: store IPv6 connection status after valid connection [29]
  o imap: deal with commands case insensitively [30]
  o --interface: add support for Linux VRF [32]
  o content_encoding: fix inflate_stream for no bytes available [33]
  o cmake: Correctly include curl.rc in Windows builds [34]
  o cmake: Add missing setmode check [35]
  o connect.c: remove executable bit on file [36]
  o SMB: fix uninitialized local variable
  o zlib/brotli: only include header files in modules needing them [37]
  o URL: return error on malformed URLs with junk after IPv6 bracket [38]
  o openssl: fix too broad use of HAVE_OPAQUE_EVP_PKEY [39]
  o macOS: Fix missing connectx function with Xcode version older than 9.0 [40]
  o --resolve: allow IP address within [] brackets [41]
  o examples/curlx: Fix code style [42]
  o ntlm: remove unnecessary NULL-check to please scan-build [43]
  o Curl_llist_remove: fix potential NULL pointer deref [43]
  o mime: fix "Value stored to 'sz' is never read" scan-build error [43]
  o openssl: fix "Value stored to 'rc' is never read" scan-build error [43]
  o http2: fix "Value stored to 'hdbuf' is never read" scan-build error [43]
  o http2: fix "Value stored to 'end' is never read" scan-build error [43]
  o Curl_open: fix OOM return error correctly [43]
  o url: reject ASCII control characters and space in host names [44]
  o examples/rtsp: clear RANGE again after use [45]
  o connect: improve the bind error message [46]
  o make: fix "make distclean" [50]
  o connect: add support for new TCP Fast Open API on Linux [51]
  o metalink: fix memory-leak and NULL pointer dereference [52]
  o URL: update "file:" URL handling [53]
  o ssh: remove check for a NULL pointer [54]
  o global_init: ignore CURL_GLOBAL_SSL's absense [55]

This release includes the following known bugs:

o see docs/KNOWN_BUGS (https://curl.haxx.se/docs/knownbugs.html)

This release would not have looked like this without help, code, reports and
advice from friends like these:

   Alessandro Ghedini, Alex Malinovich, Alex Nichols, Alfonso Martone,
   Andrew Lambert, arainchik on github, Brian Carpenter, cbartl on github,
   Dan Fandrich, Daniel Bankhead, Daniel Stenberg, Dirk Feytons,
   Dmitri Tikhonov, Evgeny Grin, Gisle Vanem, hsiao yi, Jakub Zakrzewski,
   John Starks, Juro Bystricky, Kamil Dudka, Luca Boccassi, Marcel Raad,
   Martin Storsj�, Matthew Kerwin, Max Dymond, Michael Felt, Michael Kaufmann,
   moohoorama on github, omau on github, Orgad Shaneh, Patrick Monnerat,
   Paul Howarth, Pavel Gushchin, Pavol Markovic, Per Lundberg, Peter Piekarski,
   Petr Voytsik, Ray Satiro, Rob Cotrone, Viktor Szak�ts, youngchopin on github,
   (41 contributors)

Thanks! (and sorry if I forgot to mention someone)

References to bug reports and discussions on issues:

-- 
  / daniel.haxx.se

-----------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-users
Etiquette: https://curl.haxx.se/mail/etiquette.html
Received on 2017-11-29

This message: [ Message body ]
Next message: Daniel Stenberg: "[SECURITY ADVISORY] curl: NTLM buffer overflow via integer overflow"
Previous message: Daniel Stenberg: "Re: Is my "Time Spent" erroneous?"

Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]