Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

haxx libcurl 7.36.0 vulnerabilities and exploits

(subscribe to this query)
5
CVSSv2
CVE-2014-3620
cURL and libcurl prior to 7.38.0 allow remote malicious users to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.
Haxx Curl 7.35.0Haxx Curl 7.32.0Haxx Curl 7.33.0Haxx Curl 7.36.0Haxx CurlHaxx Curl 7.31.0Haxx Curl 7.34.0Haxx Curl 7.37.0Haxx Libcurl 7.37.0Haxx Libcurl 7.33.0Haxx Libcurl 7.36.0Haxx Libcurl 7.34.0Haxx Libcurl 7.31.0Haxx Libcurl 7.35.0Haxx LibcurlHaxx Libcurl 7.32.0Apple Mac Os X
5.8
CVSSv2
CVE-2014-8151
The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 up to and including 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows...
Apple Mac Os XHaxx Libcurl 7.31.0Haxx Libcurl 7.32.0Haxx Libcurl 7.38.0Haxx Libcurl 7.39Haxx Libcurl 7.37.0Haxx Libcurl 7.37.1Haxx Libcurl 7.33.0Haxx Libcurl 7.34.0Haxx Libcurl 7.35.0Haxx Libcurl 7.36.0
4
CVSSv2
CVE-2014-2522
curl and libcurl 7.27.0 up to and including 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when acces...
Haxx Libcurl 7.35.0Haxx Libcurl 7.36.0Haxx Libcurl 7.28.1Haxx Libcurl 7.27.0Haxx Curl 7.29.0Haxx Curl 7.28.0Haxx Libcurl 7.31.0Haxx Libcurl 7.30.0Haxx Curl 7.33.0Haxx Curl 7.32.0Haxx Libcurl 7.32.0Haxx Libcurl 7.33.0Haxx Libcurl 7.34.0Haxx Curl 7.35.0Haxx Curl 7.34.0Haxx Curl 7.28.1Haxx Curl 7.27.0Haxx Libcurl 7.29.0Haxx Libcurl 7.28.0Haxx Curl 7.31.0Haxx Curl 7.30.0
7.5
CVSSv2
CVE-2015-3145
The sanitize_cookie_path function in cURL and libcurl 7.31.0 up to and including 7.41.0 does not properly calculate an index, which allows remote malicious users to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie pa...
Fedoraproject Fedora 21Fedoraproject Fedora 22Canonical Ubuntu Linux 12.04Debian Debian Linux 7.0Canonical Ubuntu Linux 15.04Canonical Ubuntu Linux 14.10Canonical Ubuntu Linux 14.04Haxx Curl 7.37.1Haxx Curl 7.38.0Haxx Curl 7.33.0Haxx Curl 7.34.0Haxx Curl 7.35.0Haxx Curl 7.41.0Haxx Curl 7.36.0Haxx Curl 7.37.0Haxx Curl 7.31.0Haxx Curl 7.32.0Haxx Curl 7.39.0Haxx Curl 7.40.0Apple Mac Os X 10.10.2Apple Mac Os X 10.10.3Apple Mac Os X 10.10.0
6.4
CVSSv2
CVE-2014-0138
The default configuration in cURL and libcurl 7.10.6 prior to 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent malicious users to connect as other users via a...
Haxx Curl 7.10.6Haxx Curl 7.12.2Haxx Curl 7.12.3Haxx Curl 7.15.1Haxx Curl 7.15.2Haxx Curl 7.16.3Haxx Curl 7.16.4Haxx Curl 7.19.2Haxx Curl 7.19.3Haxx Curl 7.21.0Haxx Curl 7.21.1Haxx Curl 7.22.0Haxx Curl 7.23.0Haxx Curl 7.23.1Haxx Curl 7.29.0Haxx Curl 7.30.0Haxx Libcurl 7.10.8Haxx Libcurl 7.11.0Haxx Libcurl 7.13.1Haxx Libcurl 7.13.2Haxx Libcurl 7.15.4Haxx Libcurl 7.15.5
5.8
CVSSv2
CVE-2014-0139
cURL and libcurl 7.1 prior to 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle malicious users to spoof arbitrary SSL...
Haxx Curl 7.12.0Haxx Curl 7.12.1Haxx Curl 7.15.0Haxx Curl 7.15.1Haxx Curl 7.16.2Haxx Curl 7.16.3Haxx Curl 7.19.0Haxx Curl 7.19.1Haxx Curl 7.20.1Haxx Curl 7.21.0Haxx Curl 7.21.7Haxx Curl 7.22.0Haxx Curl 7.28.0Haxx Curl 7.28.1Haxx Libcurl 7.10.7Haxx Curl 7.10.8Haxx Curl 7.11.0Haxx Curl 7.13.0Haxx Curl 7.13.1Haxx Curl 7.13.2Haxx Curl 7.15.4Haxx Curl 7.15.5
2.6
CVSSv2
CVE-2016-3739
The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl prior to 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote malicious users to spo...
Haxx Curl 7.48.0Haxx Curl 7.47.0Haxx Curl 7.41.0Haxx Curl 7.40.0Haxx Curl 7.31.0Haxx Curl 7.30.0Haxx Curl 7.24.0Haxx Curl 7.23.1Haxx Curl 7.21.3Haxx Curl 7.21.2Haxx Curl 7.42.1Haxx Curl 7.42.0Haxx Curl 7.34.0Haxx Curl 7.33.0Haxx Curl 7.32.0Haxx Curl 7.26.0Haxx Curl 7.25.0Haxx Curl 7.21.5Haxx Curl 7.21.4Haxx Curl 7.43.0Haxx Curl 7.46.0Haxx Curl 7.36.0
4.3
CVSSv2
CVE-2021-22890
curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as ...
Haxx LibcurlFedoraproject Fedora 32Fedoraproject Fedora 33Fedoraproject Fedora 34Netapp Solidfire -Netapp Hci Management Node -Netapp Hci Storage Node -Broadcom Fabric Operating System -Debian Debian Linux 9.0Siemens Sinec Infrastructure Network ServicesOracle Communications Billing And Revenue Management 12.0.0.3.0Oracle Essbase 21.2Splunk Universal Forwarder 9.1.0Splunk Universal Forwarder
5
CVSSv2
CVE-2018-16890
libcurl versions from 7.36.0 to prior to 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vul...
Haxx LibcurlCanonical Ubuntu Linux 16.04Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 18.10Debian Debian Linux 9.0Netapp Clustered Data OntapSiemens Sinema Remote Connect ClientOracle Http Server 12.2.1.3.0Oracle Secure Global Desktop 5.4Oracle Communications Operations Monitor 3.4Oracle Communications Operations Monitor 4.0Redhat Enterprise Linux 8.0F5 Big-ip Access Policy Manager
7.5
CVSSv2
CVE-2019-3822
libcurl versions from 7.36.0 to prior to 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously receive...
Haxx LibcurlCanonical Ubuntu Linux 16.04Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 18.10Debian Debian Linux 9.0Netapp Snapcenter -Netapp Oncommand Workflow Automation -Netapp Oncommand Insight -Netapp Active Iq Unified ManagerNetapp Clustered Data OntapSiemens Sinema Remote Connect ClientOracle Http Server 12.2.1.3.0Oracle Enterprise Manager Ops Center 12.3.3Oracle Secure Global Desktop 5.4Oracle Communications Operations Monitor 3.4Oracle Communications Operations Monitor 4.0Oracle Enterprise Manager Ops Center 12.4.0Oracle Services Tools Bundle 19.2Oracle Mysql ServerRedhat Enterprise Linux 8.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionCVE-2006-4304CVE-2023-26603CVE-2024-28327CVE-2023-50363CVE-2024-21905template injectionCVE-2024-3400cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook