Loading HuntDB...

CVE-2022-43552: HTTP Proxy deny use-after-free

Low
C
curl
Submitted None
Reported by bagder

Vulnerability Details

Technical details and impact analysis

Use After Free
Issue(s) reported by Trail of Bits. This is either one or two issues. ## Summary: `./src/curl 0 -x0:80 telnet:/[j-u][j-u]//0 -m 01` `./src/curl 0 -x0:80 smb:/[j-u][j-u]//0 -m 01` Both command line ends up having libcurl access and use already freed heap-memory. For read and write. ## Steps To Reproduce: See above, run with valgrind for full report. I have a local HTTP server on localhost host port 80 that will send back a 502 on the CONNECT requests curl issues to it for these protocols. ## Supporting Material/References: See logs. ## Impact Use after free stuff.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Use After Free