Huge Curl vulnerability about to drop

Prior to reading the linked story, I was expecting something... different.

It's released:

• Release blog post
• CVE-2023-38545: SOCKS5 heap buffer overflow
• How I made a heap overflow in curl

lucihaj Oh, that’s not that bad, they all made it sound so much worse than it really is

desultory He’s been complaining about bogus CVEs and he’s not the only one suffering from those either as far as i know…

toast if you use SOCKS5

People using Tor are heavily sweating

mycelium if you’re using curl over Tor i think you have a different problem, especially if you don’t have modern security compilation flags on anything including your libc that would prevent exploitation of this