curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the pro…

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2022-42915 · Microsoft / collected KEV context

cve-program · CVE-2022-42915

• https://curl.se/docs/CVE-2022-42915.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/
• https://security.netapp.com/advisory/ntap-20221209-0010/
• https://security.gentoo.org/glsa/202212-01
• https://support.apple.com/kb/HT213604
• https://support.apple.com/kb/HT213605
• http://seclists.org/fulldisclosure/2023/Jan/20
• http://seclists.org/fulldisclosure/2023/Jan/19

No related operational record is retained in the current change model.