Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-9j2c-vm53-wcvm

Опубликовано: 30 мар. 2023
Источник: github
Github: Не прошло ревью
CVSS3: 5.9

Описание

A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.

A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.

EPSS

Процентиль: 18%
0.00059
Низкий

5.9 Medium

CVSS3

Дефекты

CWE-415

Связанные уязвимости

CVSS3: 5.9
ubuntu
почти 3 года назад

A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.

CVSS3: 5.6
redhat
почти 3 года назад

A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.

CVSS3: 5.9
nvd
почти 3 года назад

A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.

CVSS3: 5.9
msrc
почти 3 года назад

Описание отсутствует

CVSS3: 5.9
debian
почти 3 года назад

A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS ...

EPSS

Процентиль: 18%
0.00059
Низкий

5.9 Medium

CVSS3

Дефекты

CWE-415