USN-6429-3: curl vulnerabilities
USN-6429-1 fixed vulnerabilities in curl. This update provides the corresponding updates for Ubuntu 23.10. Original advisory details: Jay Satiro discovered that curl incorrectly handled hostnames when using a SOCKS5 proxy. In environments where curl is configured to use a SOCKS5 proxy, a remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-38545) It was discovered that curl incorrectly handled cookies when an application duplicated certain handles. A local attacker could possibly create a cookie file and inject arbitrary cookies into subsequent connections. (CVE-2023-38546)
Affected Software
Event History
Frequently Asked Questions
What vulnerability does USN-6429-3 fix?
USN-6429-3 fixes vulnerabilities in curl.
What is the severity of USN-6429-3?
The severity of USN-6429-3 is not specified.
How does USN-6429-3 impact Ubuntu 23.10?
USN-6429-3 provides corresponding updates for Ubuntu 23.10 to address the vulnerabilities in curl.
What are the affected software packages for USN-6429-3?
The affected software packages for USN-6429-3 are curl, libcurl3-gnutls, libcurl3-nss, and libcurl4.
How can I fix the vulnerabilities addressed in USN-6429-3?
To fix the vulnerabilities addressed in USN-6429-3, update the affected software packages to version 8.2.1-1ubuntu3.1 or later.