Moderate: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

SUSE SLES15: libnss_slurm2 / libpmi0 / libslurm35 / perl-slurm / slurm / etc (SUSE-SU-2023:4116-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:4116-1 advisory. - CVE-2023-41914: Fixed several filesystem handling race conditions that could lead to an attacker taking control of an arbitrary file bsc1216207...

SUSE SLES15: libnss_slurm2 / libpmi0 / libslurm36 / perl-slurm / slurm / etc (SUSE-SU-2023:4114-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:4114-1 advisory. - CVE-2023-41914: Fixed a filesystem handling race conditions that could lead to an attacker taking control of an arbitrary file. bsc1216207 Tenable ha...

SUSE SLES12: libnss_slurm2_20_02 / libpmi0_20_02 / libslurm35 / perl-slurm_20_02 / etc (SUSE-SU-2023:4119-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4119-1 advisory. - CVE-2023-41914: Fixed a filesystem handling race conditions that could lead to an attacker taking control of an arbitrary file. bsc1216207...

BELL-CVE-2023-3359 CVE-2023-3359 does not affect BellSoft software

Bulletin has no description...

AZL-31502 CVE-2023-38546 affecting package cmake for versions less than 3.21.4-10

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a functio...

AZL-34610 CVE-2023-38546 affecting package cmake for versions less than 3.21.4-10

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a functio...

DEBIAN-CVE-2023-38546

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a functio...

AZL-38099 CVE-2023-38546 affecting package tensorflow for versions less than 2.16.1-1

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a functio...

AZL-31289 CVE-2023-38546 affecting package curl for versions less than 8.3.0-2

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a functio...

ALPINE-CVE-2023-38546

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a functio...

curl security update

7.76.1-23.el92.4 - curl: a heap-based buffer overflow in the SOCKS5 proxy handshake CVE-2023-38545 - curl: cookie injection with none file CVE-2023-38546...

SUSE CVE-2023-38546

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a functio...

cookie injection with none file

This flaw allows an attacker to intentionally inject cookies into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a...

UBUNTU-CVE-2023-38546

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a functio...

Important: curl

Issue Overview: An issue was found in curl that can cause a buffer overflow in its SOCKS5 proxy communications code. When curl is using a SOCKS5 proxy and it needs to resolve a hostname to an IP address, its default behavior is to pass the hostname to the proxy and allow it to perform the...

This flaw allows an attacker to insert cookies at will into a running program using libcurl if the specific series of conditions are met. libcurl performs transfers. In its API an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies enabled when the handle is duplicated the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program usin

...

PT-2023-6067 · Microsoft · Refs +1

Name of the Vulnerable Software and Affected Versions: Microsoft Resilient File System ReFS affected versions not specified Description: The issue is related to insecure privilege management in the Windows Resilient File System, which can be exploited to elevate privileges. This allows an attacke...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the curleasyduphandle function, allowing an attacker to insert cookies into a running program using this library. When this function is used to duplicate an easy handle with cookies enabled, the...

PT-2023-5886 · Libcurl +13 · Libcurl +13

Name of the Vulnerable Software and Affected Versions: libcurl versions prior to 8.4.0 Description: This issue allows an attacker to insert cookies at will into a running program using libcurl, if specific series of conditions are met. libcurl performs transfers and provides a function call that...