USN-6237-1

Dashboard / Vulnerabilities / USN-6237-1

USN-6237-1

Summary: curl vulnerabilities

Details: Hiroki Kurosawa discovered that curl incorrectly handled validating certain certificate wildcards. A remote attacker could possibly use this issue to spoof certain website certificates using IDN hosts. (CVE-2023-28321) Hiroki Kurosawa discovered that curl incorrectly handled callbacks when certain options are set by applications. This could cause applications using curl to misbehave, resulting in information disclosure, or a denial of service. (CVE-2023-28322) It was discovered that curl incorrectly handled saving cookies to files. A local attacker could possibly use this issue to create or overwrite files. This issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)

References: https://ubuntu.com/security/notices/USN-6237-1, https://ubuntu.com/security/CVE-2023-28321, https://ubuntu.com/security/CVE-2023-28322, https://ubuntu.com/security/CVE-2023-32001