I’m confused. Why hasn’t been curl updated to latest version 8.4.0? The widely used tool has a vulnerability that can be exploited to cause a heap-based buffer overflow issue. The release of curl 8.4.0, on October 11, addresses a vulnerability listed as CVE-2023-38545, which can be exploited to cau…

curl 8.4.0-0 has now been released to Testing and Stable branches

CVE-2023-38545 was reported to curl project September 30, 2023. The curl github announcement has a comment in response to questions about delaying release Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11 · curl/curl · Discussion #12026 · GitHub there is a minuscule risk t…

is pamac or pacman using curl to dl the packages?

No. Though, it may be possible, I imagine. However, many foreign software installation procedures in the wild actively promote using curl to download packages, or source prior to building. [image] gigitek: The release of curl 8.4.0, on October 11, addresses a vulnerability listed as CVE-2023-38…

[image] nikgnomic: curl was updated on Arch - 2023-10-12 22:43 UTC - Arch Linux - curl 8.4.0-2 (x86_64) (12 hours ago at time of this post) That is not quite correct, the above is the second update for 8.4.0, package release 2: Making sure you're not a bot!

I just installed it, tumps up! That everyone see this topic right now. Thanks to the devs for the quick update :100:

[image] Kobold: I just installed it, tumps up! What’s a tump? :man_shrugging:

An opposing, two-digit component on your ant. :ant:

Oh, OK, I thought at first that it was something more political. … Donald Tump … Now I understand the confusion. :crazy_face:

[image] soundofthunder: … Donald Tump … Let’s… not go there. :joy:

Manjaro Linux Forum

Why hasn’t been curl updated to latest version 8.4.0?

Support Software & Applications