SUSE SLES12 Security Update : curl (SUSE-SU-2023:4043-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4043-1 advisory. - CVE-2023-38545: Fixed a heap buffer overflow in SOCKS5. bsc1215888 - CVE-2023-38546: Fixed a cookie injection with none file...

Fedora 38 : curl (2023-b855de5c0f)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-b855de5c0f advisory. - fix cookie injection with none file CVE-2023-38546 - fix SOCKS5 heap buffer overflow CVE-2023-38545 Tenable has extracted the preceding descriptio...

SUSE SLED15: curl / libcurl-devel / libcurl-devel-32bit / libcurl4 / etc (SUSE-SU-2023:4044-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4044-1 advisory. - CVE-2023-38545: Fixed a heap buffer overflow in SOCKS5. bsc1215888 - CVE-2023-38546: Fixed a...

SOCKS5 heap buffer overflow

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255 bytes. If the hostname ...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current curl Multiple Vulnerabilities (SSA:2023-284-01)

The version of curl installed on the remote host is prior to 8.4.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-284-01 advisory. - CVE-2023-38545 is a heap-based buffer overflow vulnerability in the SOCKS5 proxy handshake in libcurl and curl. When curl is...

Debian DSA-5523-1 : curl - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5523 advisory. - CVE-2023-38545 is a heap-based buffer overflow vulnerability in the SOCKS5 proxy handshake in libcurl and curl. When curl is given a hostname to pass along...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-377)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-377 advisory. An issue was found in curl that can cause a buffer overflow in its SOCKS5 proxy communications code. When curl is using a SOCKS5 proxy and it needs to resolve a hostname to an IP address, its...

curl -- SOCKS5 heap buffer overflow

The curl team reports: This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255...