Advisories » MGASA-2023-0288

Updated the curl packages to fix two security vulnerabilities

Publication date: 13 Oct 2023
Modification date: 13 Oct 2023
Type: security
Affected Mageia releases : 8 , 9
CVE: CVE-2023-38545 , CVE-2023-38546

Description

curl/libcurl is vulnerable to a heap buffer overflow in its SOCKS5
support that could be exploited by a remote web server when curl is
configured to use a SOCKS5 proxy with remote hostname resolution.

libcurl is vulnerable to a cookie injection attack where a local
attacker can inject cookies into certain vulnerable applications using
libcurl.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=32362
• https://curl.se/docs/CVE-2023-38545.html
• https://curl.se/docs/CVE-2023-38546.html
• https://hackerone.com/reports/2187833
• https://hackerone.com/reports/2148242
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38545
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38546
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38545
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38546

SRPMS

9/core

• curl-7.88.1-3.2.mga9

8/core

• curl-7.74.0-1.14.mga8