- Vulnerability/
- USN-6429-3
USN-6429-3: curl vulnerabilities
First published: Tue Oct 17 2023(Updated: )
USN-6429-1 fixed vulnerabilities in curl. This update provides the corresponding updates for Ubuntu 23.10. Original advisory details: Jay Satiro discovered that curl incorrectly handled hostnames when using a SOCKS5 proxy. In environments where curl is configured to use a SOCKS5 proxy, a remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-38545) It was discovered that curl incorrectly handled cookies when an application duplicated certain handles. A local attacker could possibly create a cookie file and inject arbitrary cookies into subsequent connections. (CVE-2023-38546)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/curl | <8.2.1-1ubuntu3.1 | 8.2.1-1ubuntu3.1 |
| =23.10 | ||
| All of | ||
| ubuntu/libcurl3-gnutls | <8.2.1-1ubuntu3.1 | 8.2.1-1ubuntu3.1 |
| =23.10 | ||
| All of | ||
| ubuntu/libcurl3-nss | <8.2.1-1ubuntu3.1 | 8.2.1-1ubuntu3.1 |
| =23.10 | ||
| All of | ||
| ubuntu/libcurl4 | <8.2.1-1ubuntu3.1 | 8.2.1-1ubuntu3.1 |
| =23.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What vulnerability does USN-6429-3 fix?
USN-6429-3 fixes vulnerabilities in curl.
What is the severity of USN-6429-3?
The severity of USN-6429-3 is not specified.
How does USN-6429-3 impact Ubuntu 23.10?
USN-6429-3 provides corresponding updates for Ubuntu 23.10 to address the vulnerabilities in curl.
What are the affected software packages for USN-6429-3?
The affected software packages for USN-6429-3 are curl, libcurl3-gnutls, libcurl3-nss, and libcurl4.
How can I fix the vulnerabilities addressed in USN-6429-3?
To fix the vulnerabilities addressed in USN-6429-3, update the affected software packages to version 8.2.1-1ubuntu3.1 or later.
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- collector/usn
- source/Ubuntu
- anchor-related/USN-6429-1
- anchor-related/USN-6429-2
- agent/software-canonical-lookup
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/23.10