Search for packages
| purl | pkg:deb/debian/curl@7.18.2-8lenny6 |
| Next non-vulnerable version | 7.88.1-10+deb12u7 |
| Latest non-vulnerable version | 7.88.1-10+deb12u14 |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-18wr-yaee-vycy
Aliases: CVE-2014-3620 |
Affected by 96 other vulnerabilities. |
|
|
VCID-1bg9-85q6-bya3
Aliases: CVE-2018-14618 |
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.) |
Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-1j37-y6ex-pbfb
Aliases: CVE-2020-19909 |
Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially plausible because the overflow only happens if the user was trying to specify that curl should wait weeks (or longer) before trying to recover from a transient error. |
Affected by 12 other vulnerabilities. |
|
VCID-1ypr-54n1-27hn
Aliases: CVE-2024-8096 |
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate. |
Affected by 0 other vulnerabilities. |
|
VCID-2tzr-9m67-a7gh
Aliases: CVE-2012-0036 |
Affected by 108 other vulnerabilities. |
|
|
VCID-3hax-q2kc-eye5
Aliases: CVE-2018-1000120 GHSA-674j-7m97-j2p9 |
A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse. |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-3j31-rzu1-dkc9
Aliases: CVE-2014-0138 |
Affected by 108 other vulnerabilities. Affected by 96 other vulnerabilities. |
|
|
VCID-3pz4-p8n7-mfe7
Aliases: CVE-2016-8617 |
The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`. |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-3zfn-535d-mkbg
Aliases: CVE-2018-1000005 |
libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `:` to the target buffer, while this was recently changed to `: ` (a space was added after the colon) but the following math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something. |
Affected by 43 other vulnerabilities. |
|
VCID-4mdh-6sq4-vqfc
Aliases: CVE-2023-27535 |
An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information. |
Affected by 12 other vulnerabilities. |
|
VCID-4z4r-thrt-p7e7
Aliases: CVE-2019-3823 |
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller. |
Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-5ar4-qmah-yyhr
Aliases: CVE-2017-1000101 |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
|
VCID-5gj7-gcw3-quhy
Aliases: CVE-2015-3145 |
Affected by 67 other vulnerabilities. |
|
|
VCID-64ub-z1u6-u3ht
Aliases: CVE-2018-1000121 |
A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-67tv-9g7a-eqhe
Aliases: CVE-2014-0139 |
Affected by 108 other vulnerabilities. Affected by 96 other vulnerabilities. |
|
|
VCID-6g4s-g758-gyek
Aliases: CVE-2016-8624 |
curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them. |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-6gre-wwgj-afce
Aliases: CVE-2019-5435 |
An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. |
Affected by 43 other vulnerabilities. |
|
VCID-6sgd-qvge-u7cw
Aliases: CVE-2017-8816 |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
|
VCID-7b6t-h7w2-a7am
Aliases: CVE-2022-32208 |
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. |
Affected by 12 other vulnerabilities. |
|
VCID-7c3e-97qs-ube7
Aliases: CVE-2016-8621 |
The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short. |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-7cxc-5tec-g3gm
Aliases: CVE-2022-27776 |
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number. |
Affected by 12 other vulnerabilities. |
|
VCID-7d74-hmrj-7feq
Aliases: CVE-2022-32205 |
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method. |
Affected by 12 other vulnerabilities. |
|
VCID-7g8x-2u49-myfk
Aliases: CVE-2009-0037 |
Affected by 111 other vulnerabilities. |
|
|
VCID-7y7r-5b1u-zugq
Aliases: CVE-2022-32207 |
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended. |
Affected by 12 other vulnerabilities. |
|
VCID-8bk1-uzgp-7ydp
Aliases: CVE-2020-8169 |
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s). |
Affected by 43 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-8dgw-m6bw-tfez
Aliases: CVE-2023-38545 |
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with. |
Affected by 12 other vulnerabilities. |
|
VCID-8tpr-75uh-g3d5
Aliases: CVE-2013-4545 |
Affected by 108 other vulnerabilities. Affected by 96 other vulnerabilities. |
|
|
VCID-934d-h1a6-d7dg
Aliases: CVE-2016-5421 |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
|
VCID-97dy-wejs-yqe4
Aliases: CVE-2015-3236 |
lingering HTTP credentials in connection re-use |
Affected by 67 other vulnerabilities. |
|
VCID-9n9j-kk6t-jfdw
Aliases: CVE-2018-16842 |
Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service. |
Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-9p7y-56mq-gkav
Aliases: CVE-2018-16890 |
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds. |
Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-9tk9-a11p-r7fb
Aliases: CVE-2017-7407 |
Affected by 67 other vulnerabilities. |
|
|
VCID-a3bj-tpnb-ekc8
Aliases: CVE-2016-8616 |
A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password. |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-a63f-dgdt-qkeu
Aliases: CVE-2023-28321 |
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`. |
Affected by 12 other vulnerabilities. |
|
VCID-a7cg-46em-5uaa
Aliases: CVE-2020-8231 |
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data. |
Affected by 43 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-acrb-uq4p-8bef
Aliases: CVE-2024-2398 |
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application. |
Affected by 12 other vulnerabilities. |
|
VCID-ae2d-dcng-pfe9
Aliases: CVE-2017-1000100 |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
|
VCID-b3n4-qjn2-x7dx
Aliases: CVE-2023-28322 |
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST. |
Affected by 12 other vulnerabilities. |
|
VCID-bcy1-pmzv-9ucq
Aliases: CVE-2013-0249 |
Affected by 96 other vulnerabilities. |
|
|
VCID-bfvw-myxs-u7fn
Aliases: CVE-2016-8623 |
A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure. |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-bmc9-d3cf-nfc4
Aliases: CVE-2015-3148 |
Affected by 108 other vulnerabilities. Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
|
VCID-btqv-a3xd-47dc
Aliases: CVE-2022-22576 |
An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only). |
Affected by 12 other vulnerabilities. |
|
VCID-cf1z-1bxk-r7hs
Aliases: CVE-2013-2174 |
Affected by 108 other vulnerabilities. Affected by 96 other vulnerabilities. |
|
|
VCID-d5k5-2r4p-tqat
Aliases: CVE-2016-9586 |
curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks. |
Affected by 67 other vulnerabilities. |
|
VCID-dt8u-p2t3-mbfv
Aliases: CVE-2016-8618 |
The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables. |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-e95e-aesj-fua5
Aliases: CVE-2023-27536 |
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. |
Affected by 12 other vulnerabilities. |
|
VCID-eqtp-pvnk-q7bb
Aliases: CVE-2016-7141 |
Affected by 67 other vulnerabilities. |
|
|
VCID-f78a-6yr3-2kd7
Aliases: CVE-2018-16839 |
Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service. |
Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-fnu8-rhf3-9uat
Aliases: CVE-2021-22876 |
Affected by 43 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
|
VCID-g7m2-cu4w-abes
Aliases: CVE-2023-27538 |
An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection. |
Affected by 12 other vulnerabilities. |
|
VCID-gxy3-42ff-6bf8
Aliases: CVE-2018-1000300 |
curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This vulnerability appears to have been fixed in curl < 7.54.1 and curl >= 7.60.0. |
Affected by 43 other vulnerabilities. |
|
VCID-j1a6-7226-ebd5
Aliases: CVE-2014-0015 |
Affected by 108 other vulnerabilities. Affected by 96 other vulnerabilities. |
|
|
VCID-j54s-7998-2qav
Aliases: CVE-2017-8817 |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
|
VCID-jb7y-7s8j-hug4
Aliases: CVE-2013-1944 |
Affected by 96 other vulnerabilities. |
|
|
VCID-jnrx-6gb8-ybdf
Aliases: CVE-2021-22946 |
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network. |
Affected by 12 other vulnerabilities. |
|
VCID-kefk-hzbz-5bh8
Aliases: CVE-2022-27775 |
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead. |
Affected by 12 other vulnerabilities. |
|
VCID-kgqf-t8vs-wkbp
Aliases: CVE-2016-8619 |
The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free. |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-kng1-n79f-8uhe
Aliases: CVE-2021-22924 |
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate. |
Affected by 12 other vulnerabilities. |
|
VCID-ksnr-v863-xuf1
Aliases: CVE-2011-3389 |
Affected by 108 other vulnerabilities. |
|
|
VCID-kupk-757c-d7bh
Aliases: CVE-2017-1000257 |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
|
VCID-kxcf-6r7j-afge
Aliases: CVE-2020-8284 |
Affected by 43 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
|
VCID-m1uj-dxcq-quf1
Aliases: CVE-2011-2192 |
Affected by 108 other vulnerabilities. |
|
|
VCID-my1j-3tu8-jyf6
Aliases: CVE-2019-5482 |
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. |
Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-p1sw-ra86-akau
Aliases: CVE-2018-16840 |
A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. |
Affected by 43 other vulnerabilities. |
|
VCID-p9ee-pzsz-77gh
Aliases: CVE-2014-3707 |
Affected by 108 other vulnerabilities. Affected by 96 other vulnerabilities. |
|
|
VCID-prgz-2eea-47du
Aliases: CVE-2015-3153 |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
|
VCID-prr8-xszv-87bg
Aliases: CVE-2016-7167 |
Affected by 67 other vulnerabilities. |
|
|
VCID-pzuz-3b4a-a3hn
Aliases: CVE-2018-0500 |
Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value). |
Affected by 43 other vulnerabilities. |
|
VCID-q57u-fcr8-t7er
Aliases: CVE-2023-27534 |
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user. |
Affected by 12 other vulnerabilities. |
|
VCID-qgr5-ua84-cqf3
Aliases: CVE-2023-27533 |
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system. |
Affected by 12 other vulnerabilities. |
|
VCID-qshs-bp9m-wyg5
Aliases: CVE-2023-38546 |
This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course. |
Affected by 12 other vulnerabilities. |
|
VCID-r47x-jtx4-akfm
Aliases: CVE-2022-32221 |
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST. |
Affected by 12 other vulnerabilities. |
|
VCID-rbgk-zqkz-zbhb
Aliases: CVE-2022-27774 |
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers. |
Affected by 12 other vulnerabilities. |
|
VCID-rcux-u2gs-muaj
Aliases: CVE-2022-43552 |
A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path. |
Affected by 12 other vulnerabilities. |
|
VCID-rpcy-cmfw-8ydm
Aliases: CVE-2023-46218 |
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain. |
Affected by 12 other vulnerabilities. |
|
VCID-rpg6-erjk-7kfx
Aliases: CVE-2021-22890 |
Affected by 43 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
|
VCID-rs7d-h1fd-rffh
Aliases: CVE-2016-8622 |
The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer. |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-scmm-h2kh-p7f9
Aliases: CVE-2024-7264 |
libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used. |
Affected by 12 other vulnerabilities. |
|
VCID-sw9g-nwdh-23c9
Aliases: CVE-2015-3144 |
Affected by 67 other vulnerabilities. |
|
|
VCID-szwk-ndws-cfgp
Aliases: CVE-2016-0755 |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
|
VCID-thvp-m8ct-sfbz
Aliases: CVE-2010-0734 |
Affected by 111 other vulnerabilities. |
|
|
VCID-tj1j-bpq4-2fau
Aliases: CVE-2018-1000007 |
libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request. |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-tmsh-7adv-z3hu
Aliases: CVE-2016-3739 |
TLS certificate check bypass with mbedTLS/PolarSSL |
Affected by 67 other vulnerabilities. |
|
VCID-tsyn-uzsk-9ke6
Aliases: CVE-2014-3613 |
Affected by 108 other vulnerabilities. Affected by 96 other vulnerabilities. |
|
|
VCID-tuju-mv12-pugm
Aliases: CVE-2018-1000122 |
A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-u5gc-vvmc-augw
Aliases: CVE-2015-3143 |
Affected by 108 other vulnerabilities. Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
|
VCID-umjy-kc55-9yd4
Aliases: CVE-2022-27781 |
Affected by 12 other vulnerabilities. |
|
|
VCID-uqcv-edu5-b3ft
Aliases: CVE-2019-5436 |
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. |
Affected by 43 other vulnerabilities. |
|
VCID-uv1g-n7b4-y3eq
Aliases: CVE-2014-8150 |
Affected by 108 other vulnerabilities. Affected by 96 other vulnerabilities. |
|
|
VCID-v58g-8vb2-83e6
Aliases: CVE-2017-2629 |
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status). |
Affected by 67 other vulnerabilities. |
|
VCID-vedv-nete-bfeg
Aliases: CVE-2016-5420 |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
|
VCID-vkf1-a88h-6fbu
Aliases: CVE-2017-1000254 |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
|
VCID-vuqg-nmkm-3bfq
Aliases: CVE-2016-8620 |
The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input. |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-vzak-p5wn-nfd3
Aliases: CVE-2022-32206 |
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors. |
Affected by 12 other vulnerabilities. |
|
VCID-waah-usbn-33cq
Aliases: CVE-2016-5419 |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
|
VCID-wftf-7b9p-sbdb
Aliases: CVE-2023-23916 |
An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors. |
Affected by 12 other vulnerabilities. |
|
VCID-wm39-c25y-93g1
Aliases: CVE-2021-22947 |
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server. |
Affected by 12 other vulnerabilities. |
|
VCID-wyw5-k1mb-u7h8
Aliases: CVE-2016-8615 |
A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar. |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. |
|
VCID-x12g-2vba-zkbb
Aliases: CVE-2021-22945 |
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*. |
Affected by 12 other vulnerabilities. |
|
VCID-x25w-g1xm-uqcm
Aliases: CVE-2022-27782 |
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily. |
Affected by 12 other vulnerabilities. |
|
VCID-x457-pbfh-77hd
Aliases: CVE-2009-2417 |
Affected by 111 other vulnerabilities. |
|
|
VCID-xbze-jwf8-xbd4
Aliases: CVE-2020-8285 |
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing. |
Affected by 43 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-y4ws-1ba4-qkhj
Aliases: CVE-2021-22898 |
curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol. |
Affected by 12 other vulnerabilities. |
|
VCID-y5z7-fbgn-qbdk
Aliases: CVE-2020-8286 |
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. |
Affected by 43 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-y7qc-ppg3-87b4
Aliases: CVE-2013-6422 |
Affected by 108 other vulnerabilities. Affected by 96 other vulnerabilities. |
|
|
VCID-ybxb-2par-s7e8
Aliases: CVE-2016-8625 |
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host. |
Affected by 67 other vulnerabilities. |
|
VCID-ymr4-q1sq-63ck
Aliases: CVE-2019-5481 |
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. |
Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-yrjx-9nbx-97e6
Aliases: CVE-2019-3822 |
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header. |
Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-yy2j-s6sn-vqd7
Aliases: CVE-2020-8177 |
curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used. |
Affected by 43 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-z1st-v825-jucv
Aliases: CVE-2017-8818 |
Affected by 43 other vulnerabilities. |
|
|
VCID-z2kk-kdaa-ckbh
Aliases: CVE-2022-35252 |
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings. |
Affected by 12 other vulnerabilities. |
|
VCID-z3dx-avjj-qfd8
Aliases: CVE-2017-7468 |
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range. |
Affected by 67 other vulnerabilities. |
|
VCID-ze2y-dwjd-jfa8
Aliases: CVE-2018-1000301 |
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0. |
Affected by 96 other vulnerabilities. Affected by 67 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-zm7a-dsd1-eudp
Aliases: CVE-2015-3237 |
SMB send off unrelated memory contents |
Affected by 67 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-5x4b-d54b-zfe3 |
CVE-2007-3564
|