By not detecting and rejecting domain names for partial literal IP
addresses properly when parsing received HTTP cookies, libcurl can
be fooled to both sending cookies to wrong sites and into allowing
arbitrary sites to set cookies for others.

For Debian 6 Squeeze, these issues have been fixed in curl version 7.21.0-2.1+squeeze9

CPENameOperatorVersion
curleq7.21.0-1
curleq7.21.0-2
curleq7.21.0-2.1+squeeze1
curleq7.21.0-2.1+squeeze2
curleq7.21.0-2.1+squeeze3
curleq7.21.0-2.1+squeeze4
curleq7.21.0-2.1+squeeze5
curleq7.21.0-2.1+squeeze6
curleq7.21.0-2.1+squeeze7
curleq7.21.0-2.1+squeeze8

Name	Operator	Version
curl	eq	7.21.0-1
curl	eq	7.21.0-2
curl	eq	7.21.0-2.1+squeeze1
curl	eq	7.21.0-2.1+squeeze2
curl	eq	7.21.0-2.1+squeeze3
curl	eq	7.21.0-2.1+squeeze4
curl	eq	7.21.0-2.1+squeeze5
curl	eq	7.21.0-2.1+squeeze6
curl	eq	7.21.0-2.1+squeeze7
curl	eq	7.21.0-2.1+squeeze8