VulnerableCode Package Details - pkg:alpm/archlinux/libcurl-gnutls@7.84.0-1

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-66xg-3bn3-aaaj	When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.	CVE-2022-32208
VCID-nyr1-ne57-aaas	When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally widen the permissions for the target file, leaving the updated file accessible to more users than intended.	CVE-2022-32207
VCID-vffj-n1n7-aaah	curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.	CVE-2022-32206

Vulnerability

Summary

Aliases

VCID-66xg-3bn3-aaaj

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

CVE-2022-32208

VCID-nyr1-ne57-aaas

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.

CVE-2022-32207

VCID-vffj-n1n7-aaah

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.

CVE-2022-32206

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-03-28T07:44:01.280686+00:00	Arch Linux Importer	Fixing	VCID-vffj-n1n7-aaah	https://security.archlinux.org/AVG-2817	36.0.0
2025-03-28T07:44:01.252196+00:00	Arch Linux Importer	Fixing	VCID-nyr1-ne57-aaas	https://security.archlinux.org/AVG-2817	36.0.0
2025-03-28T07:44:01.223640+00:00	Arch Linux Importer	Fixing	VCID-66xg-3bn3-aaaj	https://security.archlinux.org/AVG-2817	36.0.0
2024-01-20T20:18:47.767193+00:00	Arch Linux Importer	Fixing	VCID-vffj-n1n7-aaah	https://security.archlinux.org/AVG-2817	34.0.0rc2
2024-01-20T20:18:47.749788+00:00	Arch Linux Importer	Fixing	VCID-nyr1-ne57-aaas	https://security.archlinux.org/AVG-2817	34.0.0rc2
2024-01-20T20:18:47.732384+00:00	Arch Linux Importer	Fixing	VCID-66xg-3bn3-aaaj	https://security.archlinux.org/AVG-2817	34.0.0rc2