VulnerableCode Package Details - pkg:alpm/archlinux/libcurl-gnutls@7.83.1-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-66xg-3bn3-aaaj Aliases: CVE-2022-32208	When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.	7.84.0-1 Affected by 0 other vulnerabilities.
VCID-nyr1-ne57-aaas Aliases: CVE-2022-32207	When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally widen the permissions for the target file, leaving the updated file accessible to more users than intended.	7.84.0-1 Affected by 0 other vulnerabilities.
VCID-vffj-n1n7-aaah Aliases: CVE-2022-32206	curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.	7.84.0-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-66xg-3bn3-aaaj
Aliases:
CVE-2022-32208

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

7.84.0-1
Affected by 0 other vulnerabilities.

VCID-nyr1-ne57-aaas
Aliases:
CVE-2022-32207

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.

7.84.0-1
Affected by 0 other vulnerabilities.

VCID-vffj-n1n7-aaah
Aliases:
CVE-2022-32206

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.

7.84.0-1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-03-28T07:44:01.275854+00:00	Arch Linux Importer	Affected by	VCID-vffj-n1n7-aaah	https://security.archlinux.org/AVG-2817	36.0.0
2025-03-28T07:44:01.246438+00:00	Arch Linux Importer	Affected by	VCID-nyr1-ne57-aaas	https://security.archlinux.org/AVG-2817	36.0.0
2025-03-28T07:44:01.218745+00:00	Arch Linux Importer	Affected by	VCID-66xg-3bn3-aaaj	https://security.archlinux.org/AVG-2817	36.0.0
2024-01-20T20:18:47.762466+00:00	Arch Linux Importer	Affected by	VCID-vffj-n1n7-aaah	https://security.archlinux.org/AVG-2817	34.0.0rc2
2024-01-20T20:18:47.745052+00:00	Arch Linux Importer	Affected by	VCID-nyr1-ne57-aaas	https://security.archlinux.org/AVG-2817	34.0.0rc2
2024-01-20T20:18:47.727602+00:00	Arch Linux Importer	Affected by	VCID-66xg-3bn3-aaaj	https://security.archlinux.org/AVG-2817	34.0.0rc2