CVE-2023-28319

🗓️ 26 May 2023 00:00:00Reported by hackeroneType

A use after free vulnerability in curl <v8.1.0 allows insertion of sensitive heap-based data into error messages

Reporter	Title	Published	Views	Family All 104
IBM Security Bulletins	Security Bulletin: IBM MaaS360 Cloud Extender Agent, Configuration Utility, Certificate, and Base Module affected by multiple vulnerabilities (CVE-2023-28322, CVE-2023-28320, CVE-2023-28319, CVE-2023-28321)	2 Oct 202316:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Wincollect is vulnerable to using components with known vulnerabilities	24 Jul 202317:54	–	ibm
IBM Security Bulletins	Security Bulletin: Execution Engine for Apache Hadoop is vulnerable to heap-based buffer overflow and remote attacker to bypass security restrictions	20 Feb 202503:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in libcurl, cURL and Linux Kernel might affect IBM Storage Copy Data Management	14 Jun 202416:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC	25 Sep 202320:08	–	ibm
FreeBSD	curl -- multiple vulnerabilities	21 Mar 202300:00	–	freebsd
ATTACKERKB	CVE-2023-28319	26 May 202321:15	–	attackerkb
Tenable Nessus	Amazon Linux 2 : curl (ALAS-2023-2230)	8 Sep 202300:00	–	nessus
Tenable Nessus	FreeBSD : curl -- multiple vulnerabilities (a4f8bb03-f52f-11ed-9859-080027083a05)	19 May 202300:00	–	nessus

NVD

Vulners

Node

haxx curlRange<8.1.0

Node

apple macosRange11.0–11.7.9

apple macosRange12.0–12.6.8

apple macosRange13.0–13.5

Node

netapp clustered_data_ontapMatch-

netapp ontap_antivirus_connectorMatch-

Node

netapp h300s_firmwareMatch-

AND

netapp h300sMatch-

Node

netapp h500s_firmwareMatch-

AND

netapp h500sMatch-

Node

netapp h700s_firmwareMatch-

AND

netapp h700sMatch-

Node

netapp h410s_firmwareMatch-

AND

netapp h410sMatch-

[
  {
    "vendor": "n/a",
    "product": "https://github.com/curl/curl",
    "versions": [
      {
        "version": "Fixed in 8.1.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
hackerone	www.hackerone.com/reports/1913733
support	www.support.apple.com/kb/HT213844
security	www.security.netapp.com/advisory/ntap-20230609-0009/
support	www.support.apple.com/kb/HT213845
security	www.security.gentoo.org/glsa/202310-12
seclists	www.seclists.org/fulldisclosure/2023/Jul/48
seclists	www.seclists.org/fulldisclosure/2023/Jul/47
seclists	www.seclists.org/fulldisclosure/2023/Jul/52
support	www.support.apple.com/kb/HT213843

15 Jan 2025 16:15Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.5

EPSS0.0032

SSVC

CWE-416