Summary
USN-6237-1 fixed several vulnerabilities in curl. This update provides the
corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and
Ubuntu 18.04 LTS.
Original advisory details:
Hiroki Kurosawa discovered that curl incorrectly handled validating certain
certificate wildcards. A remote attacker could possibly use this issue to
spoof certain website certificates using IDN hosts. (CVE-2023-28321)
Hiroki Kurosawa discovered that curl incorrectly handled callbacks when
certain options are set by applications. This could cause applications
using curl to misbehave, resulting in information disclosure, or a denial
of service. (CVE-2023-28322)
It was discovered that curl incorrectly handled saving cookies to files. A
local attacker could possibly use this issue to create or overwrite files.
This issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | curl | 7.35.0-1ubuntu2.20+esm16 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | curl | 7.47.0-1ubuntu2.19+esm9 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | curl | 7.58.0-2ubuntu3.24+esm1 |
Vulnerabilities 2
-
Medium 5.9
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard pat…
-
Medium 5.3
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously …