Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Mageia: 2023-0288 Moderate: Curl Heap Overflow & Cookie Injection

mageia
Calendar Grey October 13, 2023
Dist Mageia Esm H88
Mageia 2023-0289 addresses severe security issues in libxml2 concerning XML parsing flaws and entity expansion, impacting remote interactions.
curl/libcurl is vulnerable to a heap buffer overflow in its SOCKS5 support that could be exploited by a remote web server when curl is configured to use a SOCKS5 proxy with remote ...

Summary

curl/libcurl is vulnerable to a heap buffer overflow in its SOCKS5 support that could be exploited by a remote web server when curl is configured to use a SOCKS5 proxy with remote hostname resolution.
libcurl is vulnerable to a cookie injection attack where a local attacker can inject cookies into certain vulnerable applications using libcurl.

References

- https://bugs.mageia.org/show_bug.cgi?id=32362

- https://curl.se/docs/CVE-2023-38545.html

- https://curl.se/docs/CVE-2023-38546.html

- https://hackerone.com/reports/2187833

- https://hackerone.com/reports/2148242

- https://www.cve.org/CVERecord?id=CVE-2023-38545

- https://www.cve.org/CVERecord?id=CVE-2023-38546

- https://www.cve.org/CVERecord?id=CVE-2023-38545

- https://www.cve.org/CVERecord?id=CVE-2023-38546

Topics%20covered

Topics Covered

security advisory moderate curl heap buffer overflow SOCKS5 cookie injection Mageia

Resolution

SRPMS

- 9/core/curl-7.88.1-3.2.mga9

- 8/core/curl-7.74.0-1.14.mga8

Publication date: 13 Oct 2023
URL: https://advisories.mageia.org/MGASA-2023-0288.html
Type: security
CVE: CVE-2023-38545, CVE-2023-38546

Topics%20covered

Topics Covered

security advisory moderate curl heap buffer overflow SOCKS5 cookie injection Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here