security advisorybuffer overflowdebian Two security issues were found in Curl, an easy-to-use client-side URL transfer library and command line tool: CVE-2023-38545 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5523-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Moritz Muehlenhoff October 11, 2023 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : curl CVE ID : CVE-2023-38545 CVE-2023-38546 Two security issues were found in Curl, an easy-to-use client-side URL transfer library and command line tool: CVE-2023-38545 Jay Satiro discovered a buffer overflow in the SOCKS5 proxy handshake. CVE-2023-38546 It was discovered that under some circumstances libcurl was susceptible to cookie injection. For the oldstable distribution (bullseye), these problems have been fixed in version 7.74.0-1.3+deb11u10. For the stable distribution (bookworm), these problems have been fixed in version 7.88.1-10+deb12u4. We recommend that you upgrade your curl packages. For the detailed security status of curl please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/curl Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Multiple vulnerabilities patched in Curl for Debian: CVE-2023-38712 & CVE-2023-38713 with new version releases.. Curl Security Update, Debian DSA-5523-1, Buffer Overflow Fix. . Severity: Important. LinuxSecurity.com Team
Oct 11, 2023 •Important Debian