High ELSA-2023-6745 2 CVEs

Important: curl security update (Oracle Linux 9)

Published Nov 16, 2023 · Updated Nov 16, 2023

Ecosystem: Oracle Linux

Summary

[7.76.1-26.el9_3.2]
- fix cookie injection with none file (CVE-2023-38546)

[7.76.1-26.el9_3.1]
- socks: return error if hostname too long for remote resolve (CVE-2023-38545)

Fixed packages 5

Release	Package	Fixed in
Oracle Linux · 9	curl	0:7.76.1-26.el9_3.2
Oracle Linux · 9	curl-minimal	0:7.76.1-26.el9_3.2
Oracle Linux · 9	libcurl	0:7.76.1-26.el9_3.2
Oracle Linux · 9	libcurl-devel	0:7.76.1-26.el9_3.2
Oracle Linux · 9	libcurl-minimal	0:7.76.1-26.el9_3.2

Vulnerabilities 2

High 8.8

CVE-2023-38545 Public exploit EPSS 78%

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the h…

curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi

Oct 18, 2023
Unscored —

CVE-2023-38546

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of …

curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi

Oct 18, 2023