2 matches found
SUSE-SU-2024:2784-1 Security update for curl
This update for curl fixes the following issues: - CVE-2024-7264: Fixed ASN.1 date parser overread bsc1228535 - CVE-2024-6197: Fixed freeing stack buffer in utf8asn1str bsc1227888...
CVE-2024-6197
libcurl's ASN1 parser has this utf8asn1str function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes free on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort...