CVE-2022-43552: HTTP Proxy deny use-after-free
Low
C
curl
Submitted None
Actions:
Reported by
bagder
Vulnerability Details
Technical details and impact analysis
Issue(s) reported by Trail of Bits. This is either one or two issues.
## Summary:
`./src/curl 0 -x0:80 telnet:/[j-u][j-u]//0 -m 01`
`./src/curl 0 -x0:80 smb:/[j-u][j-u]//0 -m 01`
Both command line ends up having libcurl access and use already freed heap-memory. For read and write.
## Steps To Reproduce:
See above, run with valgrind for full report.
I have a local HTTP server on localhost host port 80 that will send back a 502 on the CONNECT requests curl issues to it for these protocols.
## Supporting Material/References:
See logs.
## Impact
Use after free stuff.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Use After Free