Red Hat Security AdvisoryRHSA-2015:2159
curl security, bug fix, and enhancement update
Released 2015-11-19 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) curl-7.29.0-25.el7, libcurl-7.29.0-25.el7
- Red Hat Enterprise Linux Client Optional (v. 7) libcurl-devel-7.29.0-25.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) curl-7.29.0-25.el7, libcurl-7.29.0-25.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libcurl-devel-7.29.0-25.el7
- Red Hat Enterprise Linux Server (v. 7) curl-7.29.0-25.el7, libcurl-7.29.0-25.el7, libcurl-7.29.0-25.el7.ppc +2
- Red Hat Enterprise Linux Workstation (v. 7) curl-7.29.0-25.el7, libcurl-7.29.0-25.el7, libcurl-devel-7.29.0-25.el7
Fixes 5 records
Priority LOW 38
cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.1415 · Published 2015-04-24 · Partial fix CWE-284
Priority LOW 36
cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.11149 · Published 2015-04-24 · Partial fix CWE-264
Priority LOW 33
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.1…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.07145 · Published 2014-11-18 · Partial fix CWE-310
Priority LOW 30
CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.0681 · Published 2015-01-15 · Partial fix
Priority LOW 28
The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.05121 · Published 2014-11-15 · Partial fix CWE-200
THREATIST.IORead the docs