Curl is vulnerable to double free. The vulnerability is due to the use of HTTP proxy for a transfer with a non-HTTP(S) URL which allows an attacker to trigger a double free.
seclists.org/fulldisclosure/2023/Jan/19
seclists.org/fulldisclosure/2023/Jan/20
curl.se/docs/CVE-2022-42915.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/
lists.fedoraproject.org/archives/list/[email protected]/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/
lists.fedoraproject.org/archives/list/[email protected]/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/
lists.fedoraproject.org/archives/list/[email protected]/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/
secdb.alpinelinux.org/edge/main.yaml
secdb.alpinelinux.org/v3.15/main.yaml
secdb.alpinelinux.org/v3.16/main.yaml
security.gentoo.org/glsa/202212-01
security.netapp.com/advisory/ntap-20221209-0010/
support.apple.com/kb/HT213604
support.apple.com/kb/HT213605