Updated curl packages fix security vulnerabilities:

NTLM-authenticated connections could be wrongly reused for requests
without any credentials set, leading to HTTP requests being sent over
the connection authenticated as a different user (CVE-2015-3143).

When parsing HTTP cookies, if the parsed cookie’s path element consists
of a single double-quote, libcurl would try to write to an invalid
heap memory address. This could allow remote attackers to cause a
denial of service (crash) (CVE-2015-3145).

When doing HTTP requests using the Negotiate authentication
method along with NTLM, the connection used would not be marked
as authenticated, making it possible to reuse it and send requests
for one user over the connection authenticated as a different user
(CVE-2015-3148).