Hi

I just wanted to mention that if you patched an older libcurl version with the
patch I produced (and as far as I've seen most distributions and providers
did), you should know that the patch is not fully working for 7.14.0 and
earlier.

Wilfried Weissmann filed a Redhat bug report (175358) where he correctly had
identified one particular version which made me do some further research.

For libcurl 7.14.0 and earlier (down to and including 7.11.2) you must modify
the patch to do +3 instead of only doing +2. The reason for that is that the
default string in those old versions was "/" and not just a singe zero byte.

The patch available at http://curl.haxx.se/libcurl-urllen.patch has been
adjusted and this new version is believed to work for all libcurl versions
from 7.11.2 to and including 7.15.0.

I've also updated both http://curl.haxx.se/docs/security.html and
http://curl.haxx.se/docs/adv_20051207.html to include this news.

Sorry for all the trouble.

-- 
  Commercial curl and libcurl Technical Support: http://haxx.se/curl.html