Lookup for vulnerable packages by Package URL.
| Purl | pkg:conan/libcurl@7.84.0 |
|---|
| Type | conan |
|---|
| Namespace | |
|---|
| Name | libcurl |
|---|
| Version | 7.84.0 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | true |
|---|
| Next_non_vulnerable_version | null |
|---|
| Latest_non_vulnerable_version | null |
|---|
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-3h9c-dfvd-g3a4 |
| vulnerability_id |
VCID-3h9c-dfvd-g3a4 |
| summary |
Time-of-check Time-of-use (TOCTOU) Race Condition
libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When
doing this, it called `stat()` followed by `fopen()` in a way that made it
vulnerable to a TOCTOU race condition problem.
By exploiting this flaw, an attacker could trick the victim to create or
overwrite protected files holding this data in ways it was not intended to. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-32001
|
| risk_score |
2.5 |
| exploitability |
0.5 |
| weighted_severity |
5.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3h9c-dfvd-g3a4 |
|
|
|---|
| Fixing_vulnerabilities |
|
|---|
| Risk_score | 2.5 |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:conan/libcurl@7.84.0 |
|---|