OESA-2023-1443

Dashboard / Vulnerabilities / OESA-2023-1443

OESA-2023-1443

Summary: curl security update

Details: cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. Security Fix(es): libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called `stat()` followed by `fopen()` in a way that made it vulnerable to a TOCTOU race condition problem. By exploiting this flaw, an attacker could trick the victim to create or overwrite protected files holding this data in ways it was not intended to. (CVE-2023-32001)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1443, https://nvd.nist.gov/vuln/detail/CVE-2023-32001