Our beloved cURL utility is afflicted with a heap buffer overflow (CVE-2023-38545) that looks like it requires a few separate conditions to be successful. Super interesting work by Ray Satiro, one day I might understand most of what he's written.
Have a look and then go check if your applications using libcurl are setting CURLOPT_BUFFERSIZE to smaller than 65541 or unset.
curl disclosed on HackerOne: CVE-2023-38545: socks5 heap buffer...
# Summary: The SOCKS5 state machine can be manipulated by a remote attacker to overflow heap memory if four conditions are met: 1. The request is made via socks5h. 2. The state machine's negotiation buffer is smaller than ~65k. 3. The SOCKS server's "hello" reply is delayed. 4. The attacker sets a final destination hostname larger than the negotiation buffer. libcurl is supposed to disable...
