From 659e69704ad9480846c68a1e4c3a8f37ed5eda90 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Sat, 10 Jan 2026 19:07:29 +0100 Subject: [PATCH] package/libcurl: security bump to version 8.18.0 https://curl.se/ch/8.18.0.html Fixes CVE-2025-13034, CVE-2025-14017, CVE-2025-14524, CVE-2025-14819, CVE-2025-15079 & CVE-2025-15224: https://curl.se/docs/vuln-8.17.0.html Signed-off-by: Bernd Kuhls Signed-off-by: Julien Olivain (cherry picked from commit 39aaf317d5f6f511faa3459ca54e021f72b5d0f2) Signed-off-by: Thomas Perale --- package/libcurl/libcurl.hash | 4 ++-- package/libcurl/libcurl.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/libcurl/libcurl.hash b/package/libcurl/libcurl.hash index 786d030171..de3f2402e9 100644 --- a/package/libcurl/libcurl.hash +++ b/package/libcurl/libcurl.hash @@ -1,5 +1,5 @@ # Locally calculated after checking pgp signature -# https://curl.se/download/curl-8.17.0.tar.xz.asc +# https://curl.se/download/curl-8.18.0.tar.xz.asc # signed with key 27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2 -sha256 955f6e729ad6b3566260e8fef68620e76ba3c31acf0a18524416a185acf77992 curl-8.17.0.tar.xz +sha256 40df79166e74aa20149365e11ee4c798a46ad57c34e4f68fd13100e2c9a91946 curl-8.18.0.tar.xz sha256 e18f1989333b70044b2adfb7dc2f905d0119dbdcac3bc9f4bc9d540e3a29de5b COPYING diff --git a/package/libcurl/libcurl.mk b/package/libcurl/libcurl.mk index 6924631735..e1e5a7facb 100644 --- a/package/libcurl/libcurl.mk +++ b/package/libcurl/libcurl.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBCURL_VERSION = 8.17.0 +LIBCURL_VERSION = 8.18.0 LIBCURL_SOURCE = curl-$(LIBCURL_VERSION).tar.xz LIBCURL_SITE = https://curl.se/download LIBCURL_DEPENDENCIES = host-pkgconf \