USN-6237-3: curl Ubuntu
Vulnerability summary
USN-6237-3 is a vulnerability in curl Ubuntu with no CVSS score yet.
Advisory lineage
Upstream 2 · Downstream 0 · Related 2Timeline
- 11-09-2023PublishedVulnerability first disclosed.
- 29-06-2026Last modifiedVulnerability information updated.
Description
curl vulnerabilities USN-6237-1 fixed several vulnerabilities in curl. This update provides the corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. Original advisory details: Hiroki Kurosawa discovered that curl incorrectly handled validating certain certificate wildcards. A remote attacker could possibly use this issue to spoof certain website certificates using IDN hosts. (CVE-2023-28321) Hiroki Kurosawa discovered that curl incorrectly handled callbacks when certain options are set by applications. This could cause applications using curl to misbehave, resulting in information disclosure, or a denial of service. (CVE-2023-28322) It was discovered that curl incorrectly handled saving cookies to files. A local attacker could possibly use this issue to create or overwrite files. This issue only affected Ubuntu 22.10, and Ubuntu 23.04. (CVE-2023-32001)
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu1 product
- curl< 7.35.0-1ubuntu2.20+esm16 | < 7.47.0-1ubuntu2.19+esm9 | < 7.58.0-2ubuntu3.24+esm1
1 vendor · 1 product