Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

haxx libcurl 7.29.0 vulnerabilities and exploits

(subscribe to this query)
4
CVSSv2
CVE-2014-2522
curl and libcurl 7.27.0 up to and including 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when acces...
Haxx Libcurl 7.35.0Haxx Libcurl 7.36.0Haxx Libcurl 7.28.1Haxx Libcurl 7.27.0Haxx Curl 7.29.0Haxx Curl 7.28.0Haxx Libcurl 7.31.0Haxx Libcurl 7.30.0Haxx Curl 7.33.0Haxx Curl 7.32.0Haxx Libcurl 7.32.0Haxx Libcurl 7.33.0Haxx Libcurl 7.34.0Haxx Curl 7.35.0Haxx Curl 7.34.0Haxx Curl 7.28.1Haxx Curl 7.27.0Haxx Libcurl 7.29.0Haxx Libcurl 7.28.0Haxx Curl 7.31.0Haxx Curl 7.30.0
4
CVSSv2
CVE-2013-6422
The GnuTLS backend in libcurl 7.21.4 up to and including 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote malicious users to spoof server...
Debian Debian Linux 7.0Canonical Ubuntu Linux 12.10Canonical Ubuntu Linux 13.10Canonical Ubuntu Linux 12.04Canonical Ubuntu Linux 13.04Haxx Libcurl 7.30.0Haxx Libcurl 7.28.0Haxx Libcurl 7.23.1Haxx Libcurl 7.21.4Haxx Libcurl 7.27.0Haxx Libcurl 7.26.0Haxx Libcurl 7.25.0Haxx Libcurl 7.24.0Haxx Libcurl 7.33.0Haxx Libcurl 7.32.0Haxx Libcurl 7.21.5Haxx Libcurl 7.21.6Haxx Libcurl 7.21.7Haxx Libcurl 7.31.0Haxx Libcurl 7.29.0Haxx Libcurl 7.28.1Haxx Libcurl 7.23.0
4.3
CVSSv2
CVE-2013-4545
cURL and libcurl 7.18.0 up to and including 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle malicious...
Haxx Curl 7.32.0Haxx Curl 7.18.2Haxx Curl 7.18.1Haxx Curl 7.19.5Haxx Curl 7.19.2Haxx Curl 7.21.5Haxx Curl 7.21.2Haxx Curl 7.25.0Haxx Curl 7.26.0Haxx Curl 7.19.0Haxx Curl 7.19.6Haxx Curl 7.20.1Haxx Curl 7.21.6Haxx Curl 7.21.1Haxx Curl 7.22.0Haxx Curl 7.28.0Haxx Curl 7.29.0Haxx Curl 7.31.0Haxx Curl 7.19.7Haxx Curl 7.19.4Haxx Curl 7.21.7Haxx Curl 7.21.4
6.4
CVSSv2
CVE-2014-0138
The default configuration in cURL and libcurl 7.10.6 prior to 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent malicious users to connect as other users via a...
Haxx Curl 7.10.6Haxx Curl 7.12.2Haxx Curl 7.12.3Haxx Curl 7.15.1Haxx Curl 7.15.2Haxx Curl 7.16.3Haxx Curl 7.16.4Haxx Curl 7.19.2Haxx Curl 7.19.3Haxx Curl 7.21.0Haxx Curl 7.21.1Haxx Curl 7.22.0Haxx Curl 7.23.0Haxx Curl 7.23.1Haxx Curl 7.29.0Haxx Curl 7.30.0Haxx Libcurl 7.10.8Haxx Libcurl 7.11.0Haxx Libcurl 7.13.1Haxx Libcurl 7.13.2Haxx Libcurl 7.15.4Haxx Libcurl 7.15.5
5.8
CVSSv2
CVE-2014-0139
cURL and libcurl 7.1 prior to 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle malicious users to spoof arbitrary SSL...
Haxx Curl 7.12.0Haxx Curl 7.12.1Haxx Curl 7.15.0Haxx Curl 7.15.1Haxx Curl 7.16.2Haxx Curl 7.16.3Haxx Curl 7.19.0Haxx Curl 7.19.1Haxx Curl 7.20.1Haxx Curl 7.21.0Haxx Curl 7.21.7Haxx Curl 7.22.0Haxx Curl 7.28.0Haxx Curl 7.28.1Haxx Libcurl 7.10.7Haxx Curl 7.10.8Haxx Curl 7.11.0Haxx Curl 7.13.0Haxx Curl 7.13.1Haxx Curl 7.13.2Haxx Curl 7.15.4Haxx Curl 7.15.5
6.8
CVSSv2
CVE-2013-2174
Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 up to and including 7.30.0 allows remote malicious users to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a &quo...
Haxx Curl 7.7Haxx Curl 7.9.3Haxx Curl 7.9.2Haxx Curl 7.10.1Haxx Curl 7.7.3Haxx Curl 7.8Haxx Curl 7.9.7Haxx Curl 7.9.6Haxx Curl 7.10.5Haxx Curl 7.10.8Haxx Curl 7.12.1Haxx Curl 7.12.2Haxx Curl 7.12.3Haxx Curl 7.15.1Haxx Curl 7.15.2Haxx Curl 7.16.1Haxx Curl 7.16.0Haxx Curl 7.19.6Haxx Curl 7.19.7Haxx Curl 7.21.6Haxx Curl 7.21.7Haxx Curl 7.22.0
2.6
CVSSv2
CVE-2016-3739
The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl prior to 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote malicious users to spo...
Haxx Curl 7.48.0Haxx Curl 7.47.0Haxx Curl 7.41.0Haxx Curl 7.40.0Haxx Curl 7.31.0Haxx Curl 7.30.0Haxx Curl 7.24.0Haxx Curl 7.23.1Haxx Curl 7.21.3Haxx Curl 7.21.2Haxx Curl 7.42.1Haxx Curl 7.42.0Haxx Curl 7.34.0Haxx Curl 7.33.0Haxx Curl 7.32.0Haxx Curl 7.26.0Haxx Curl 7.25.0Haxx Curl 7.21.5Haxx Curl 7.21.4Haxx Curl 7.43.0Haxx Curl 7.46.0Haxx Curl 7.36.0
5
CVSSv2
CVE-2020-8231
Due to use of a dangling pointer, libcurl 7.29.0 up to and including 7.71.1 can use the wrong connection when sending data.
Haxx LibcurlSiemens Sinec Infrastructure Network ServicesDebian Debian Linux 10.0Oracle Communications Cloud Native Core Policy 1.14.0Splunk Universal Forwarder 9.1.0Splunk Universal Forwarder
5
CVSSv2
CVE-2020-8286
curl 7.41.0 up to and including 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
Haxx LibcurlFedoraproject Fedora 32Fedoraproject Fedora 33Debian Debian Linux 9.0Debian Debian Linux 10.0Netapp Clustered Data Ontap -Netapp Solidfire -Netapp Hci Management Node -Netapp Hci Bootstrap Os -Netapp Hci Storage Node Firmware -Apple Mac Os XApple Mac Os X 10.14.6Apple Mac Os X 10.15.7Apple MacosSiemens Simatic Tim 1531 Irc FirmwareSiemens Sinec Infrastructure Network ServicesOracle Peoplesoft Enterprise Peopletools 8.58Oracle Communications Billing And Revenue Management 12.0.0.3.0Oracle Essbase 21.2Oracle Communications Cloud Native Core Policy 1.14.0Splunk Universal Forwarder 9.1.0Splunk Universal Forwarder
5
CVSSv2
CVE-2020-8285
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
Haxx LibcurlDebian Debian Linux 9.0Debian Debian Linux 10.0Fedoraproject Fedora 32Fedoraproject Fedora 33Netapp Clustered Data Ontap -Netapp Solidfire -Netapp Hci Management Node -Netapp Hci Bootstrap Os -Netapp Hci Storage Node Firmware -Apple Mac Os XApple Mac Os X 10.14.6Apple Mac Os X 10.15.7Apple MacosOracle Peoplesoft Enterprise Peopletools 8.58Oracle Communications Billing And Revenue Management 12.0.0.3.0Oracle Essbase 21.2Oracle Communications Cloud Native Core Policy 1.14.0Fujitsu M10-1 FirmwareFujitsu M10-4 FirmwareFujitsu M10-4s FirmwareFujitsu M12-1 Firmware
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionCVE-2006-4304CVE-2023-26603CVE-2024-28327CVE-2023-50363CVE-2024-21905template injectionCVE-2024-3400cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook