Published: 01/05/2015 Updated: 17/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Subscribe to Enterprise Manager Ops Center

The default configuration for cURL and libcurl prior to 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle enterprise manager ops center 12.3.0
oracle enterprise manager ops center 12.2.0
oracle enterprise manager ops center 12.2.1
oracle enterprise manager ops center
haxx libcurl
haxx curl
canonical ubuntu linux 15.1
canonical ubuntu linux 14.04
canonical ubuntu linux 14.10
canonical ubuntu linux 12.04
apple mac os x 10.10.4
debian debian linux 8.0

Several security issues were fixed in curl ...

It was discovered that cURL, an URL transfer library, if configured to use a proxy server with the HTTPS protocol, by default could send to the proxy the same HTTP headers it sends to the destination server, possibly leaking sensitive information For the stable distribution (jessie), this problem has been fixed in version 7380-4+deb8u2 For the ...

The default configuration for cURL and libcurl before 7421 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents ...

CWE-200 http://curl.haxx.se/docs/adv_20150429.html http://www.ubuntu.com/usn/USN-2591-1 http://www.debian.org/security/2015/dsa-3240 http://www.securitytracker.com/id/1032233 http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html https://support.apple.com/kb/HT205031 http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743 https://kc.mcafee.com/corporate/index?page=content&id=SB10131 http://www.securityfocus.com/bid/74408 http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html https://usn.ubuntu.com/2591-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2015-3153

CVE-2015-3153

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect