CU
Product
Curl
169
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 33High 57Medium 50Low 11
Watch
Add Curl to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-7407 | 2.4 | Apr 3 | The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic… Affected: 7.53.1 |
| CVE-2015-3237 | – | Jun 22 | The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service… Affected: 7.40.0; 7.41.0; 7.42.0; 7.42.1 |
| CVE-2015-3236 | – | Jun 22 | cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a… Affected: 7.40.0; 7.41.0; 7.42.0; 7.42.1 |
| CVE-2015-3153 | – | May 1 | The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain… Affected: through 7.42.0 |
| CVE-2015-3148 | – | Apr 24 | cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request Affected: 7.10.6; 7.10.7; 7.10.8; 7.11.0; 7.11.1; 7.11.2; +34 more |
| CVE-2015-3145 | – | Apr 24 | The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service… Affected: 7.31.0; 7.32.0; 7.33.0; 7.34.0; 7.35.0; 7.36.0; +6 more |
| CVE-2015-3144 | – | Apr 24 | The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds… Affected: 7.37.0; 7.37.1; 7.38.0; 7.39.0; 7.40.0; 7.41.0 |
| CVE-2015-3143 | – | Apr 24 | cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar… Affected: 7.10.6; 7.10.7; 7.10.8; 7.11.0; 7.11.1; 7.11.2; +34 more |
| CVE-2014-3620 | – | Nov 18 | cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain Affected: through 7.37.1; 7.31.0; 7.32.0; 7.33.0; 7.34.0; 7.35.0; +2 more |
| CVE-2014-3613 | – | Nov 18 | cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain… Affected: through 7.37.1; 7.31.0; 7.32.0; 7.33.0; 7.34.0; 7.35.0; +2 more |
| CVE-2014-2522 | – | Apr 18 | curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the… Affected: 7.27.0; 7.28.0; 7.28.1; 7.29.0; 7.30.0; 7.31.0; +4 more |
| CVE-2014-0139 | – | Apr 15 | cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an… Affected: 7.10.6; 7.10.7; 7.10.8; 7.11.0; 7.11.1; 7.11.2; +34 more |
| CVE-2014-0138 | – | Apr 15 | The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10)… Affected: 7.10.6; 7.10.7; 7.10.8; 7.11.0; 7.11.1; 7.11.2; +34 more |
| CVE-2014-0015 | – | Feb 2 | cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to… Affected: 7.10.6; 7.10.7; 7.10.8; 7.11.0; 7.11.1; 7.11.2; +34 more |
| CVE-2013-4545 | – | Nov 23 | cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature… Affected: 7.18.0; 7.18.1; 7.18.2; 7.19.0; 7.19.1; 7.19.2; +28 more |
| CVE-2013-2174 | – | Jul 31 | Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service… Affected: 7.7; 7.7.1; 7.7.2; 7.7.3; 7.8; 7.8.1; +34 more |
| CVE-2013-1944 | – | Apr 29 | The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies… Affected: through 7.29.0; 6.0; 6.1; 6.1; 6.2; 6.3; +34 more |
| CVE-2013-0249 | – | Mar 8 | Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5… Affected: 7.26.0; 7.27.0; 7.28.0; 7.28.1 |
| CVE-2011-3389 | – | Sep 6 | The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data… Affected: 7.10.6 through 7.23.1 |