Published: 15/01/2015 Updated: 05/01/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

CRLF injection vulnerability in libcurl 6.0 up to and including 7.x prior to 7.40.0, when using an HTTP proxy, allows remote malicious users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 7.0
haxx libcurl 6.4
haxx libcurl 6.5
haxx libcurl 7.10.4
haxx libcurl 7.10.5
haxx libcurl 7.12.0
haxx libcurl 7.12.1
haxx libcurl 7.15.0
haxx libcurl 7.15.1
haxx libcurl 7.16.2
haxx libcurl 7.16.3
haxx libcurl 7.19.0
haxx libcurl 7.19.1
haxx libcurl 7.20.1
haxx libcurl 7.21.0
haxx libcurl 7.21.7
haxx libcurl 7.22.0
haxx libcurl 7.28.0
haxx libcurl 7.28.1
haxx libcurl 7.29.0
haxx libcurl 7.36.0
haxx libcurl 7.37.0
haxx libcurl 7.5.1
haxx libcurl 7.5
haxx libcurl 7.1
haxx libcurl 7.7
haxx libcurl 7.9.1
haxx libcurl 7.9.2
haxx libcurl 6.1
haxx libcurl 6.2
haxx libcurl 7.10
haxx libcurl 7.10.1
haxx libcurl 7.10.8
haxx libcurl 7.11.0
haxx libcurl 7.13.0
haxx libcurl 7.13.1
haxx libcurl 7.13.2
haxx libcurl 7.15.4
haxx libcurl 7.15.5
haxx libcurl 7.17.1
haxx libcurl 7.18.0
haxx libcurl 7.19.5
haxx libcurl 7.19.6
haxx libcurl 7.21.3
haxx libcurl 7.21.4
haxx libcurl 7.24.0
haxx libcurl 7.25.0
haxx libcurl 7.32.0
haxx libcurl 7.33.0
haxx libcurl 7.39
haxx libcurl 7.6.1
haxx libcurl 7.4
haxx libcurl 7.3
haxx libcurl 7.7.3
haxx libcurl 7.8
haxx libcurl 7.9.5
haxx libcurl 7.9.6
haxx libcurl 6.3
haxx libcurl 6.3.1
haxx libcurl 7.10.2
haxx libcurl 7.10.3
haxx libcurl 7.11.1
haxx libcurl 7.11.2
haxx libcurl 7.14.0
haxx libcurl 7.14.1
haxx libcurl 7.16.0
haxx libcurl 7.16.1
haxx libcurl 7.18.1
haxx libcurl 7.18.2
haxx libcurl 7.19.7
haxx libcurl 7.20.0
haxx libcurl 7.21.5
haxx libcurl 7.21.6
haxx libcurl 6.0
haxx libcurl 6.5.1
haxx libcurl 6.5.2
haxx libcurl 7.10.6
haxx libcurl 7.10.7
haxx libcurl 7.12.2
haxx libcurl 7.12.3
haxx libcurl 7.26.0
haxx libcurl 7.27.0
haxx libcurl 7.34.0
haxx libcurl 7.35.0
haxx libcurl 7.6
haxx libcurl 7.5.2
haxx libcurl 7.2.1
haxx libcurl 7.2
haxx libcurl 7.1.1
haxx libcurl 7.8.1
haxx libcurl 7.9
haxx libcurl 7.9.7
haxx libcurl 7.9.8
haxx libcurl 7.15.2
haxx libcurl 7.15.3
haxx libcurl 7.16.4
haxx libcurl 7.17.0
haxx libcurl 7.19.2
haxx libcurl 7.19.3
haxx libcurl 7.19.4
haxx libcurl 7.21.1
haxx libcurl 7.21.2
haxx libcurl 7.23.0
haxx libcurl 7.23.1
haxx libcurl 7.30.0
haxx libcurl 7.31.0
haxx libcurl 7.37.1
haxx libcurl 7.38.0
haxx libcurl 7.4.2
haxx libcurl 7.4.1
haxx libcurl 7.7.1
haxx libcurl 7.7.2
haxx libcurl 7.9.3
haxx libcurl 7.9.4
canonical ubuntu linux 14.10
canonical ubuntu linux 10.04
canonical ubuntu linux 14.04
canonical ubuntu linux 12.04

Synopsis Moderate: curl security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic Updated curl packages that fix multiple security issues, several bugs, andadd two enhancements are now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as ...

curl could be tricked into adding arbitrary requests when following certain URLs ...

Andrey Labunets of Facebook discovered that cURL, an URL transfer library, fails to properly handle URLs with embedded end-of-line characters An attacker able to make an application using libcurl to access a specially crafted URL via an HTTP proxy could use this flaw to do additional requests in a way that was not intended, or insert additional re ...

The curl_easy_duphandle function in libcurl 7171 through 7380, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information (CVE-2014-3707) CRLF injection vulnerability in libcurl 60 throug ...

It was discovered that the libcurl library failed to properly handle URLs with embedded end-of-line characters An attacker able to make an application using libcurl access a specially crafted URL via an HTTP proxy could use this flaw to inject additional headers to the request or construct additional requests ...

NVD-CWE-Other http://secunia.com/advisories/62075 http://curl.haxx.se/docs/adv_20150108B.html http://secunia.com/advisories/61925 http://www.debian.org/security/2015/dsa-3122 http://secunia.com/advisories/62361 http://www.ubuntu.com/usn/USN-2474-1 http://lists.opensuse.org/opensuse-updates/2015-02/msg00040.html http://advisories.mageia.org/MGASA-2015-0020.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:021 http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147856.html http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147876.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html https://support.apple.com/kb/HT205031 http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.securityfocus.com/bid/71964 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743 https://kc.mcafee.com/corporate/index?page=content&id=SB10131 https://security.gentoo.org/glsa/201701-47 http://www.securitytracker.com/id/1032768 http://rhn.redhat.com/errata/RHSA-2015-1254.html https://access.redhat.com/errata/RHSA-2015:2159 https://usn.ubuntu.com/2474-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2014-8150

Get Started

CVE-2014-8150

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect