RELEASE-NOTES: curl 7.55.0
diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 58219d2..cb0634b 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -18,6 +18,9 @@
This release includes the following bugfixes:
+ o glob: do not parse after a strtoul() overflow range (CVE-2017-1000101) [85]
+ o tftp: reject file name lengths that don't fit (CVE-2017-1000100) [84]
+ o file: output the correct buffer to the user (CVE-2017-1000099) [83]
o includes: remove curl/curlbuild.h and curl/curlrules.h [1]
o dist: make the hugehelp.c not get regenerated unnecessarily [2]
o timers: store internal time stamps as time_t instead of doubles [3]
@@ -124,6 +127,11 @@
o darwinssl: silence compiler warnings [79]
o travis: build on osx with darwinssl
o FTP: skip unnecessary CWD when in nocwd mode [80]
+ o gssapi: fix memory leak of output token in multi round context [81]
+ o getparameter: avoid returning uninitialized 'usedarg' [82]
+ o curl (debug build) easy_events: make event data static
+ o curl: detect and bail out early on parameter integer overflows [86]
+ o configure: fix recv/send/select detection on Android [87]
This release includes the following known bugs:
@@ -133,15 +141,15 @@
advice from friends like these:
Brad Spencer, Brian Carpenter, Dan Fandrich, Daniel Stenberg,
- David E. Narváez, Dmitry Kostjuchenko, Dwarakanath Yadavalli, Evert Pot,
- Frederik B, Gisle Vanem, Hannes Magnusson, Henrik S. Gaßmann, Jakub Wilk,
- Jeremy Tan, Jeroen Ooms, Jesse Chisholm, Johannes Schindelin, Kamil Dudka,
- Marcel Raad, Martin Kepplinger, Matteo B., Max Dymond, Michael Kaufmann,
- Neil Kolban, Nick Miyake, olesteban at github, ovidiu-benea on github,
- Pascal Terjan, Paul Harris, Pavel Rochnyak, Per Malmberg, Ray Satiro,
- Rob Sanders, Ryan Winograd, Sergei Nikulov, Simon Warta, Timothe Litt,
- Viktor Szakáts,
- (38 contributors)
+ David E. Narváez, destman at github, Dmitry Kostjuchenko,
+ Dwarakanath Yadavalli, Even Rouault, Evert Pot, Frederik B, Gisle Vanem,
+ Hannes Magnusson, Henrik Gaßmann, Isaac Boukris, Jakub Wilk, Jeremy Tan,
+ Jeroen Ooms, Jesse Chisholm, Johannes Schindelin, Kamil Dudka, Marcel Raad,
+ Martin Kepplinger, Matteo B., Max Dymond, Michael Kaufmann, Neil Kolban,
+ Nick Miyake, olesteban at github, ovidiu-benea on github, Pascal Terjan,
+ Paul Harris, Pavel Rochnyak, Per Malmberg, Ray Satiro, Rob Sanders,
+ Ryan Winograd, Sergei Nikulov, Simon Warta, Timothe Litt, Viktor Szakáts,
+ (41 contributors)
Thanks! (and sorry if I forgot to mention someone)
@@ -227,3 +235,10 @@
[78] = https://curl.haxx.se/mail/lib-2017-08/0008.html
[79] = https://curl.haxx.se/bug/?i=1722
[80] = https://curl.haxx.se/bug/?i=1718
+ [81] = https://curl.haxx.se/bug/?i=1733
+ [82] = https://curl.haxx.se/bug/?i=1728
+ [83] = https://curl.haxx.se/docs/adv_20170809C.html
+ [84] = https://curl.haxx.se/docs/adv_20170809B.html
+ [85] = https://curl.haxx.se/docs/adv_20170809A.html
+ [86] = https://curl.haxx.se/bug/?i=1730
+ [87] = https://curl.haxx.se/bug/?i=1738
