Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

haxx libcurl 7.38.0 vulnerabilities and exploits

(subscribe to this query)
5.8
CVSSv2
CVE-2014-8151
The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 up to and including 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows...
Apple Mac Os XHaxx Libcurl 7.31.0Haxx Libcurl 7.32.0Haxx Libcurl 7.38.0Haxx Libcurl 7.39Haxx Libcurl 7.37.0Haxx Libcurl 7.37.1Haxx Libcurl 7.33.0Haxx Libcurl 7.34.0Haxx Libcurl 7.35.0Haxx Libcurl 7.36.0
9
CVSSv2
CVE-2015-3144
The fix_hostname function in cURL and libcurl 7.37.0 up to and including 7.41.0 does not properly calculate an index, which allows remote malicious users to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-leng...
Oracle Mysql Enterprise MonitorHaxx Curl 7.39.0Haxx Curl 7.40.0Haxx Curl 7.37.0Haxx Curl 7.41.0Haxx Curl 7.37.1Haxx Curl 7.38.0Haxx Libcurl 7.40.0Haxx Libcurl 7.41.0Haxx Libcurl 7.37.0Haxx Libcurl 7.37.1Haxx Libcurl 7.38.0Haxx Libcurl 7.39Canonical Ubuntu Linux 14.10Canonical Ubuntu Linux 12.04Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 15.04Debian Debian Linux 7.0
7.5
CVSSv2
CVE-2015-3145
The sanitize_cookie_path function in cURL and libcurl 7.31.0 up to and including 7.41.0 does not properly calculate an index, which allows remote malicious users to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie pa...
Fedoraproject Fedora 21Fedoraproject Fedora 22Canonical Ubuntu Linux 12.04Debian Debian Linux 7.0Canonical Ubuntu Linux 15.04Canonical Ubuntu Linux 14.10Canonical Ubuntu Linux 14.04Haxx Curl 7.37.1Haxx Curl 7.38.0Haxx Curl 7.33.0Haxx Curl 7.34.0Haxx Curl 7.35.0Haxx Curl 7.41.0Haxx Curl 7.36.0Haxx Curl 7.37.0Haxx Curl 7.31.0Haxx Curl 7.32.0Haxx Curl 7.39.0Haxx Curl 7.40.0Apple Mac Os X 10.10.2Apple Mac Os X 10.10.3Apple Mac Os X 10.10.0
5
CVSSv2
CVE-2014-3620
cURL and libcurl prior to 7.38.0 allow remote malicious users to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.
Haxx Curl 7.35.0Haxx Curl 7.32.0Haxx Curl 7.33.0Haxx Curl 7.36.0Haxx CurlHaxx Curl 7.31.0Haxx Curl 7.34.0Haxx Curl 7.37.0Haxx Libcurl 7.37.0Haxx Libcurl 7.33.0Haxx Libcurl 7.36.0Haxx Libcurl 7.34.0Haxx Libcurl 7.31.0Haxx Libcurl 7.35.0Haxx LibcurlHaxx Libcurl 7.32.0Apple Mac Os X
2.6
CVSSv2
CVE-2016-3739
The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl prior to 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote malicious users to spo...
Haxx Curl 7.48.0Haxx Curl 7.47.0Haxx Curl 7.41.0Haxx Curl 7.40.0Haxx Curl 7.31.0Haxx Curl 7.30.0Haxx Curl 7.24.0Haxx Curl 7.23.1Haxx Curl 7.21.3Haxx Curl 7.21.2Haxx Curl 7.42.1Haxx Curl 7.42.0Haxx Curl 7.34.0Haxx Curl 7.33.0Haxx Curl 7.32.0Haxx Curl 7.26.0Haxx Curl 7.25.0Haxx Curl 7.21.5Haxx Curl 7.21.4Haxx Curl 7.43.0Haxx Curl 7.46.0Haxx Curl 7.36.0
6.4
CVSSv2
CVE-2018-1000005
libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The pr...
Haxx LibcurlDebian Debian Linux 8.0Debian Debian Linux 9.0Canonical Ubuntu Linux 16.04Canonical Ubuntu Linux 17.10Canonical Ubuntu Linux 14.04
5
CVSSv2
CVE-2015-3153
The default configuration for cURL and libcurl prior to 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
Oracle Enterprise Manager Ops Center 12.3.0Oracle Enterprise Manager Ops Center 12.2.0Oracle Enterprise Manager Ops Center 12.2.1Oracle Enterprise Manager Ops CenterHaxx LibcurlHaxx CurlCanonical Ubuntu Linux 15.1Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 14.10Canonical Ubuntu Linux 12.04Apple Mac Os X 10.10.4Debian Debian Linux 8.0
5
CVSSv2
CVE-2016-0755
The ConnectionExists function in lib/url.c in libcurl prior to 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote malicious users to authenticate as other users via a request, a similar issue to CVE-2014-0015.
Haxx CurlCanonical Ubuntu Linux 15.10Canonical Ubuntu Linux 15.04Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 12.04Debian Debian Linux 7.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionCVE-2006-4304CVE-2023-26603CVE-2024-28327CVE-2023-50363CVE-2024-21905template injectionCVE-2024-3400cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook