cURL -- multiple vulnerabilities

The cURL project reports

• cookie injection for other servers
• case insensitive password comparison
• OOB write via unchecked multiplication
• double-free in curl_maprintf
• double-free in krb5 code
• glob parser write/read out of bounds
• curl_getdate read out of bounds
• URL unescape heap overflow via integer truncation
• Use-after-free via shared cookies
• invalid URL parsing with '#'
• IDNA 2003 makes curl use wrong host

[source]