Skip to content
OpenAdvisories
Medium USN-6237-3 2 CVEs

curl vulnerabilities

Published Sep 11, 2023 · Updated Jun 29, 2026

Summary

USN-6237-1 fixed several vulnerabilities in curl. This update provides the
corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and
Ubuntu 18.04 LTS.

Original advisory details:

Hiroki Kurosawa discovered that curl incorrectly handled validating certain
certificate wildcards. A remote attacker could possibly use this issue to
spoof certain website certificates using IDN hosts. (CVE-2023-28321)

Hiroki Kurosawa discovered that curl incorrectly handled callbacks when
certain options are set by applications. This could cause applications
using curl to misbehave, resulting in information disclosure, or a denial
of service. (CVE-2023-28322)

It was discovered that curl incorrectly handled saving cookies to files. A
local attacker could possibly use this issue to create or overwrite files.
This issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS curl 7.35.0-1ubuntu2.20+esm16
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS curl 7.47.0-1ubuntu2.19+esm9
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS curl 7.58.0-2ubuntu3.24+esm1

Vulnerabilities 2

References

  • report
    https://ubuntu.com/security/CVE-2023-28321
  • report
    https://ubuntu.com/security/CVE-2023-28322