Insyde's Security Pledge

curl: fopen race condition.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

CVE-2023-32001
libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called `stat()` followed by `fopen()` in a way that made it vulnerable to a TOCTOU race condition problem. An attacker could trick the victim to create or overwrite protected files holding this data in ways it was not intended to.

OPF RV 23.08 and after.
SPF RV 23.11 and after.