Dan Fandrich discovered that curl would incorrectly use the default set of protocols when a parameter option disabled all protocols without adding any, contrary to expectations. This issue only affected Ubuntu 23.10. (CVE-2024-2004)
It was discovered that curl incorrectly handled memory when limiting the amount of headers when HTTP/2 server push is allowed. A remote attacker could possibly use this issue to cause curl to consume resources, leading to a denial of service. (CVE-2024-2398)
{ "binaries": [ { "binary_name": "curl", "binary_version": "7.68.0-1ubuntu2.22" }, { "binary_name": "curl-dbgsym", "binary_version": "7.68.0-1ubuntu2.22" }, { "binary_name": "libcurl3-gnutls", "binary_version": "7.68.0-1ubuntu2.22" }, { "binary_name": "libcurl3-gnutls-dbgsym", "binary_version": "7.68.0-1ubuntu2.22" }, { "binary_name": "libcurl3-nss", "binary_version": "7.68.0-1ubuntu2.22" }, { "binary_name": "libcurl3-nss-dbgsym", "binary_version": "7.68.0-1ubuntu2.22" }, { "binary_name": "libcurl4", "binary_version": "7.68.0-1ubuntu2.22" }, { "binary_name": "libcurl4-dbgsym", "binary_version": "7.68.0-1ubuntu2.22" }, { "binary_name": "libcurl4-doc", "binary_version": "7.68.0-1ubuntu2.22" }, { "binary_name": "libcurl4-gnutls-dev", "binary_version": "7.68.0-1ubuntu2.22" }, { "binary_name": "libcurl4-nss-dev", "binary_version": "7.68.0-1ubuntu2.22" }, { "binary_name": "libcurl4-openssl-dev", "binary_version": "7.68.0-1ubuntu2.22" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "curl", "binary_version": "7.81.0-1ubuntu1.16" }, { "binary_name": "curl-dbgsym", "binary_version": "7.81.0-1ubuntu1.16" }, { "binary_name": "libcurl3-gnutls", "binary_version": "7.81.0-1ubuntu1.16" }, { "binary_name": "libcurl3-gnutls-dbgsym", "binary_version": "7.81.0-1ubuntu1.16" }, { "binary_name": "libcurl3-nss", "binary_version": "7.81.0-1ubuntu1.16" }, { "binary_name": "libcurl3-nss-dbgsym", "binary_version": "7.81.0-1ubuntu1.16" }, { "binary_name": "libcurl4", "binary_version": "7.81.0-1ubuntu1.16" }, { "binary_name": "libcurl4-dbgsym", "binary_version": "7.81.0-1ubuntu1.16" }, { "binary_name": "libcurl4-doc", "binary_version": "7.81.0-1ubuntu1.16" }, { "binary_name": "libcurl4-gnutls-dev", "binary_version": "7.81.0-1ubuntu1.16" }, { "binary_name": "libcurl4-nss-dev", "binary_version": "7.81.0-1ubuntu1.16" }, { "binary_name": "libcurl4-openssl-dev", "binary_version": "7.81.0-1ubuntu1.16" } ], "availability": "No subscription required" }