{"url":"http://public2.vulnerablecode.io/api/packages/192521?format=json","purl":"pkg:ebuild/net-misc/curl@7.24.0","type":"ebuild","namespace":"net-misc","name":"curl","version":"7.24.0","qualifiers":{},"subpath":"","is_vulnerable":false,"next_non_vulnerable_version":"7.34.0-r1","latest_non_vulnerable_version":"8.7.1","affected_by_vulnerabilities":[],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/65633?format=json","vulnerability_id":"VCID-1yr3-4rvr-8kcv","summary":"curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-0036.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-0036.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2012-0036","reference_id":"","reference_type":"","scores":[{"value":"0.10342","scoring_system":"epss","scoring_elements":"0.93323","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2012-0036"},{"reference_url":"https://curl.se/docs/CVE-2012-0036.html","reference_id":"","reference_type":"","scores":[{"value":"High","scoring_system":"cvssv3.1","scoring_elements":""}],"url":"https://curl.se/docs/CVE-2012-0036.html"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0036","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0036"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=773457","reference_id":"773457","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=773457"},{"reference_url":"https://security.gentoo.org/glsa/201203-02","reference_id":"GLSA-201203-02","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201203-02"},{"reference_url":"https://usn.ubuntu.com/1346-1/","reference_id":"USN-1346-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/1346-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/192521?format=json","purl":"pkg:ebuild/net-misc/curl@7.24.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:ebuild/net-misc/curl@7.24.0"}],"aliases":["CVE-2012-0036"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1yr3-4rvr-8kcv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/58901?format=json","vulnerability_id":"VCID-64mt-9155-tkbv","summary":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-3389.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-3389.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2011-3389","reference_id":"","reference_type":"","scores":[{"value":"0.03832","scoring_system":"epss","scoring_elements":"0.88361","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2011-3389"},{"reference_url":"https://curl.se/docs/CVE-2011-3389.html","reference_id":"","reference_type":"","scores":[{"value":"High","scoring_system":"cvssv3.1","scoring_elements":""}],"url":"https://curl.se/docs/CVE-2011-3389.html"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=737506","reference_id":"737506","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=737506"},{"reference_url":"https://security.gentoo.org/glsa/201111-02","reference_id":"GLSA-201111-02","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201111-02"},{"reference_url":"https://security.gentoo.org/glsa/201203-02","reference_id":"GLSA-201203-02","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201203-02"},{"reference_url":"https://security.gentoo.org/glsa/201301-01","reference_id":"GLSA-201301-01","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201301-01"},{"reference_url":"https://security.gentoo.org/glsa/201406-32","reference_id":"GLSA-201406-32","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201406-32"},{"reference_url":"https://access.redhat.com/errata/RHSA-2011:1380","reference_id":"RHSA-2011:1380","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2011:1380"},{"reference_url":"https://access.redhat.com/errata/RHSA-2011:1384","reference_id":"RHSA-2011:1384","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2011:1384"},{"reference_url":"https://access.redhat.com/errata/RHSA-2012:0006","reference_id":"RHSA-2012:0006","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2012:0006"},{"reference_url":"https://access.redhat.com/errata/RHSA-2012:0034","reference_id":"RHSA-2012:0034","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2012:0034"},{"reference_url":"https://access.redhat.com/errata/RHSA-2012:0343","reference_id":"RHSA-2012:0343","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2012:0343"},{"reference_url":"https://access.redhat.com/errata/RHSA-2012:0508","reference_id":"RHSA-2012:0508","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2012:0508"},{"reference_url":"https://access.redhat.com/errata/RHSA-2013:1455","reference_id":"RHSA-2013:1455","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2013:1455"},{"reference_url":"https://usn.ubuntu.com/1263-1/","reference_id":"USN-1263-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/1263-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/192521?format=json","purl":"pkg:ebuild/net-misc/curl@7.24.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:ebuild/net-misc/curl@7.24.0"}],"aliases":["CVE-2011-3389"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-64mt-9155-tkbv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/65630?format=json","vulnerability_id":"VCID-vnqb-6t3e-rudt","summary":"content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2010-0734.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2010-0734.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2010-0734","reference_id":"","reference_type":"","scores":[{"value":"0.0548","scoring_system":"epss","scoring_elements":"0.9037","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2010-0734"},{"reference_url":"https://curl.se/docs/CVE-2010-0734.html","reference_id":"","reference_type":"","scores":[{"value":"High","scoring_system":"cvssv3.1","scoring_elements":""}],"url":"https://curl.se/docs/CVE-2010-0734.html"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0734","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0734"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=563220","reference_id":"563220","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=563220"},{"reference_url":"https://security.gentoo.org/glsa/201203-02","reference_id":"GLSA-201203-02","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201203-02"},{"reference_url":"https://access.redhat.com/errata/RHSA-2010:0273","reference_id":"RHSA-2010:0273","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2010:0273"},{"reference_url":"https://access.redhat.com/errata/RHSA-2010:0329","reference_id":"RHSA-2010:0329","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2010:0329"},{"reference_url":"https://usn.ubuntu.com/1158-1/","reference_id":"USN-1158-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/1158-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/192521?format=json","purl":"pkg:ebuild/net-misc/curl@7.24.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:ebuild/net-misc/curl@7.24.0"}],"aliases":["CVE-2010-0734"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vnqb-6t3e-rudt"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/65632?format=json","vulnerability_id":"VCID-wc29-pw8g-mkgj","summary":"The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-2192.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-2192.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2011-2192","reference_id":"","reference_type":"","scores":[{"value":"0.02049","scoring_system":"epss","scoring_elements":"0.84184","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2011-2192"},{"reference_url":"https://curl.se/docs/CVE-2011-2192.html","reference_id":"","reference_type":"","scores":[{"value":"Medium","scoring_system":"cvssv3.1","scoring_elements":""}],"url":"https://curl.se/docs/CVE-2011-2192.html"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2192","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2192"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631615","reference_id":"631615","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631615"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=711454","reference_id":"711454","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=711454"},{"reference_url":"https://security.gentoo.org/glsa/201203-02","reference_id":"GLSA-201203-02","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201203-02"},{"reference_url":"https://access.redhat.com/errata/RHSA-2011:0918","reference_id":"RHSA-2011:0918","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2011:0918"},{"reference_url":"https://usn.ubuntu.com/1158-1/","reference_id":"USN-1158-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/1158-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/192521?format=json","purl":"pkg:ebuild/net-misc/curl@7.24.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:ebuild/net-misc/curl@7.24.0"}],"aliases":["CVE-2011-2192"],"risk_score":2.4,"exploitability":"0.5","weighted_severity":"4.8","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-wc29-pw8g-mkgj"}],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:ebuild/net-misc/curl@7.24.0"}