This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Curl and libcurl fix 2 vulnerabilities
Curl fixes 2 vulnerabilities in the curl and libcurl products with version 8.9.0 [1][2]. Among operating systems, only Debian has so far released a fix, for the sid release in version 8.9.0-1; the other Debian releases and all Ubuntu releases are not affected by the vulnerabilities [3][4][5][6].
An unauthenticated remote attacker is allowed, by means of a specially crafted TLS certificate of a web site, to crash the application, or under certain circumstances to execute code remotely. The instance is vulnerable only if it uses the GnuTLS, wolfSSL, Schannel or Secure Transport TLS backend [1].
The vulnerability is present in product:
- Curl; >=8.6.0, <8.9.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-6197 at cve.org, NVD
- CWE-590: Free of Memory not on the Heap at cwe.mitre.org
The vulnerability was publicly disclosed 24. 7. 2024.
An unauthenticated remote attacker is allowed to access potentially sensitive data of limited length originating from the stack by using a specially crafted web site name. The instance is vulnerable only if it uses an Apple operating system and the "macidn" IDN backend [2].
The vulnerability is present in product:
- Curl; >=8.8.0, <8.9.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2024-6874 at cve.org, NVD
- CWE-126: Buffer Over-read at cwe.mitre.org
The vulnerability was publicly disclosed 24. 7. 2024.
Links
- [1] https://curl.se/docs/CVE-2024-6197.html
- [2] https://curl.se/docs/CVE-2024-6874.html
- [3] https://security-tracker.debian.org/tracker/CVE-2024-6197
- [4] https://security-tracker.debian.org/tracker/CVE-2024-6874
- [5] https://ubuntu.com/security/CVE-2024-6197
- [6] https://ubuntu.com/security/CVE-2024-6874
By CESNET, z.s.p.o. Martin Krajči on 26. 7. 2024.