CVE-2023-32001

2023-07-2621:15:00

Debian Security Bug Tracker

security-tracker.debian.org

libcurl

toctou

race condition

vulnerability

saving data

files

0.0004 Low

EPSS

Percentile

9.1%

JSON

libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When
doing this, it called stat() followed by fopen() in a way that made it
vulnerable to a TOCTOU race condition problem.

By exploiting this flaw, an attacker could trick the victim to create or
overwrite protected files holding this data in ways it was not intended to.

OSVersionArchitecturePackageVersionFilename
Debian12allcurl< 7.88.1-10+deb12u1curl_7.88.1-10+deb12u1_all.deb
Debian11allcurl< 7.74.0-1.3+deb11u7curl_7.74.0-1.3+deb11u7_all.deb
Debian10allcurl< 7.64.0-4+deb10u2curl_7.64.0-4+deb10u2_all.deb
Debian999allcurl< 7.88.1-11curl_7.88.1-11_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	curl	< 7.88.1-10+deb12u1	curl_7.88.1-10+deb12u1_all.deb
Debian	11	all	curl	< 7.74.0-1.3+deb11u7	curl_7.74.0-1.3+deb11u7_all.deb
Debian	10	all	curl	< 7.64.0-4+deb10u2	curl_7.64.0-4+deb10u2_all.deb
Debian	999	all	curl	< 7.88.1-11	curl_7.88.1-11_all.deb

CVE-2023-32001

Related