curl-7.19.7-46.AXS4

cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS,
DICT, TELNET and TFTP servers, using any of the supported protocols.
cURL is designed to work without user interaction or any kind of
interactivity. cURL offers many useful capabilities, like proxy support,
user authentication, FTP upload, HTTP post, and file transfer resume.

Security issues fixed with this release:

CVE-2014-3613
CVE-2014-3707
CVE-2014-8150
CVE-2015-3143
CVE-2015-3148

Fixed bugs:

* An out-of-protocol fallback to SSL version 3.0 (SSLv3.0) was available with
libcurl. Attackers could abuse the fallback to force downgrade of the SSL
version. To fix this bug, the fallback has been removed from libcurl.
* A single upload transfer through the FILE protocol opened the destination file
twice. If the inotify kernel subsystem monitored the file, two events were
produced unnecessarily.
* Utilities using libcurl for SCP/SFTP transfers could terminate unexpectedly
when the system was running in FIPS mode.
* Using the "--retry" option with the curl utility could cause curl to terminate
unexpectedly with a segmentation fault. Now, adding "--retry" no longer causes
curl to crash.
* The "curl --trace-time" command did not use the correct local time when
printing timestamps. With this update, fixed it.
* The valgrind utility could report dynamically allocated memory leaks on curl
exit. With this update, the bug has been fixed.
* Previously, libcurl returned an incorrect value of the CURLINFO_HEADER_SIZE
field when a proxy server appended its own headers to the HTTP response. The problem
has been fixed with this update.

Enhancements:

* The "--tlsv1.0", "--tlsv1.1", and "--tlsv1.2" options are available for
specifying the minor version of the TLS protocol to be negotiated by NSS. The
"--tlsv1" option now negotiates the highest version of the TLS protocol
supported by both the client and the server.
* It is now possible to explicitly enable or disable the ECC and the new AES
cipher suites to be used for TLS.