libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When
doing this, it called stat() followed by fopen() in a way that made it
vulnerable to a TOCTOU race condition problem.

By exploiting this flaw, an attacker could trick the victim to create or
overwrite protected files holding this data in ways it was not intended to.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-32001
• https://hackerone.com/reports/2039870
• https://www.debian.org/security/2023/dsa-5460
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BGJ7POX4ATGERTSBFJPW2EQH4Z65PSZJ/