Every CVE Search/ Get API key

CVE-2016-8615

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file...

5.3 MediumFix available

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

4.72%Up 3.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

CVE List Score used 5.3

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

Record
CVE-2016-8615
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-99
Updated
2026-11-02
EUVDEUVD-2016-9460 5.3

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

Record
EUVD-2016-9460
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-hqqr-g92g-v6cf 7.5

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file...

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

Record
GHSA-hqqr-g92g-v6cf
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-99
Updated
2026-11-02
NVD 5.3

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

Record
CVE-2016-8615
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-99, CWE-254
Updated
2026-11-02
OSVALPINE-CVE-2016-8615 7.5

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

Record
ALPINE-CVE-2016-8615
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVBELL-CVE-2016-8615 7.5

CVE-2016-8615 does not affect BellSoft software

Record
BELL-CVE-2016-8615
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 15 moreShow less
OSV 7.5

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

Record
CVE-2016-8615
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2016-8615 7.5

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

Record
DEBIAN-CVE-2016-8615
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2018:3558 8.1

Red Hat Security Advisory: httpd24 security, bug fix, and enhancement update

Record
RHSA-2018:3558
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2016-8615 7.5

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

Record
UBUNTU-CVE-2016-8615
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVCLSA-2026-1777877363 No score

curl: Fix of 2 CVEs

  • CVE-2019-5436: tftp: use the current blksize for recvfrom()
  • CVE-2016-8615: cookie: replace use of fgets() with custom version
Record
CLSA-2026-1777877363
Updated
2026-11-02
OSVCLSA-2026-1777878036 No score

curl: Fix of 2 CVEs

  • CVE-2019-5436: tftp: use the current blksize for recvfrom()
  • CVE-2016-8615: cookie: replace use of fgets() with custom version
Record
CLSA-2026-1777878036
Updated
2026-11-02
OSVCURL-CVE-2016-8615 No score

cookie injection for other servers

If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

The issue pertains to the function that loads cookies into memory, which reads the specified file into a fixed-size buffer in a line-by-line manner using the fgets() function. If an invocation of fgets() cannot read the whole line into the destination buffer due to it being too small, it truncates the output. This way, a long cookie (name + value) sent by a malicious server would be stored in the file and subsequently that cookie could be read partially and crafted correctly, it could be treated as a different cookie for another server.

Record
CURL-CVE-2016-8615
Updated
2026-11-02
OSVMGASA-2018-0053 No score

Updated curl packages fix security vulnerability

If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar. The issue pertains to the function that loads cookies into memory, which reads the specified file into a fixed-size buffer in a line-by-line manner using the fgets() function. If an invocation of fgets() cannot read the whole line into the destination buffer due to it being too small, it truncates the output. This way, a very long cookie (name + value) sent by a malicious server would be stored in the file and subsequently that cookie could be read partially and crafted correctly, it could be treated as a different cookie for another server (CVE-2016-8615).

When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password (CVE-2016-8616).

In libcurl's base64 encode function, the output buffer is allocated without any checks on a variable used to determine its size. On systems with 32-bit addresses in userspace, the multiplication in the expression wraps around if the size is too large. If this happens, an undersized output buffer will be allocated, but the full result will be written, thus causing the memory behind the output buffer to be overwritten. If a username is set directly via CURLOPT_USERNAME (or curl's -u, --user option), this vulnerability can be triggered. The name has to be at least 512MB big in a 32bit system. Systems with 64 bit versions of the size_t type are not affected by this issue (CVE-2016-8617).

The libcurl API function called curl_maprintf() can be tricked into doing a double-free due to an unsafe size_t multiplication, on systems using 32 bit size_t variables. The function is also used internallty in numerous situations. The function doubles an allocated memory area with realloc() and allows the size to wrap and become zero and when doing so realloc() returns NULL and frees the memory - in contrary to normal realloc() fails where it only returns NULL - causing libcurl to free the memory again in the error path. Systems with 64 bit versions of the size_t type are not affected by this issue. This behavior is triggable using the publicly exposed function (CVE-2016-8618).

In curl's implementation of the Kerberos authentication mechanism, the function read_data() in security.c is used to fill the necessary krb5 structures. When reading one of the length fields from the socket, it fails to ensure that the length parameter passed to realloc() is not set to 0. This would lead to realloc() getting called with a zero size and when doing so realloc() returns NULL and frees the memory - in contrary to normal realloc() fails where it only returns NULL - causing libcurl to free the memory again in the error path. This flaw could be triggered by a malicious or just otherwise ill-behaving server (CVE-2016-8619).

The curl tool's "globbing" feature allows a user to specify a numerical range through which curl will iterate. The curl code for parsing the second unsigned number did not check for a leading minus character, which allowed a user to specify [1--1] with no complaints and have the latter -1 number get turned into the largest unsigned long value the system can handle. This would ultimately cause curl to write outside the dedicated malloced buffer after no less than 100,000 iterations, since it would have room for 5 digits but not 6. When the range is specified with letters, and the ending letter is left out [L-], the code would still advance its read pointer 5 bytes even if the string was just 4 bytes and end up reading outside the given buffer. This flaw exists only in the curl tool, not in the libcurl library…

Record
MGASA-2018-0053
Updated
2026-11-02
OSVopenSUSE-SU-2024:10303-1 No score

curl-7.51.0-1.1 on GA media

These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10303-1
Updated
2026-11-02
OSVSUSE-SU-2016:2699-1 No score

Security update for curl

This update for curl fixes the following security issues:

  • CVE-2016-8624: invalid URL parsing with '#' (bsc#1005646)
  • CVE-2016-8623: Use-after-free via shared cookies (bsc#1005645)
  • CVE-2016-8622: URL unescape heap overflow via integer truncation (bsc#1005643)
  • CVE-2016-8621: curl_getdate read out of bounds (bsc#1005642)
  • CVE-2016-8620: glob parser write/read out of bounds (bsc#1005640)
  • CVE-2016-8619: double-free in krb5 code (bsc#1005638)
  • CVE-2016-8618: double-free in curl_maprintf (bsc#1005637)
  • CVE-2016-8617: OOB write via unchecked multiplication (bsc#1005635)
  • CVE-2016-8616: case insensitive password comparison (bsc#1005634)
  • CVE-2016-8615: cookie injection for other servers (bsc#1005633)
  • CVE-2016-7167: escape and unescape integer overflows (bsc#998760)
Record
SUSE-SU-2016:2699-1
Updated
2026-11-02
OSVSUSE-SU-2016:2700-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2016-8624: invalid URL parsing with '#' (bsc#1005646)
  • CVE-2016-8623: Use-after-free via shared cookies (bsc#1005645)
  • CVE-2016-8621: curl_getdate read out of bounds (bsc#1005642)
  • CVE-2016-8619: double-free in krb5 code (bsc#1005638)
  • CVE-2016-8618: double-free in curl_maprintf (bsc#1005637)
  • CVE-2016-8617: OOB write via unchecked multiplication (bsc#1005635)
  • CVE-2016-8616: case insensitive password comparison (bsc#1005634)
  • CVE-2016-8615: cookie injection for other servers (bsc#1005633)
  • CVE-2016-7167: escape and unescape integer overflows (bsc#998760)
  • CVE-2016-7141: Fixed incorrect reuse of client certificates with NSS not fixed in CVE-2016-5420 (bsc#997420)
Record
SUSE-SU-2016:2700-1
Updated
2026-11-02
OSVSUSE-SU-2016:2714-1 No score

Security update for curl

This update for curl fixes the following security issues:

  • CVE-2016-8624: invalid URL parsing with '#' (bsc#1005646)
  • CVE-2016-8623: Use-after-free via shared cookies (bsc#1005645)
  • CVE-2016-8621: curl_getdate read out of bounds (bsc#1005642)
  • CVE-2016-8619: double-free in krb5 code (bsc#1005638)
  • CVE-2016-8618: double-free in curl_maprintf (bsc#1005637)
  • CVE-2016-8617: OOB write via unchecked multiplication (bsc#1005635)
  • CVE-2016-8616: case insensitive password comparison (bsc#1005634)
  • CVE-2016-8615: cookie injection for other servers (bsc#1005633)
  • CVE-2016-7167: escape and unescape integer overflows (bsc#998760)
Record
SUSE-SU-2016:2714-1
Updated
2026-11-02
OSVSUSE-SU-2017:2699-1 No score

Security update for SLES 12 Docker image

The SUSE Linux Enterprise Server 12 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

  • Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
  • Do not install recommended packages when building container images. (bsc#975726)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE cross-reference is available below.

pam:

  • CVE-2015-3238

libtasn1:

  • CVE-2015-3622
  • CVE-2016-4008

libidn:

  • CVE-2015-2059
  • CVE-2015-8948
  • CVE-2016-6261
  • CVE-2016-6262
  • CVE-2016-6263

zlib:

  • CVE-2016-9840
  • CVE-2016-9841
  • CVE-2016-9842
  • CVE-2016-9843

curl:

  • CVE-2016-5419
  • CVE-2016-5420
  • CVE-2016-5421
  • CVE-2016-7141
  • CVE-2016-7167
  • CVE-2016-8615
  • CVE-2016-8616
  • CVE-2016-8617
  • CVE-2016-8618
  • CVE-2016-8619
  • CVE-2016-8620
  • CVE-2016-8621
  • CVE-2016-8622
  • CVE-2016-8623
  • CVE-2016-8624
  • CVE-2016-9586
  • CVE-2017-1000100
  • CVE-2017-1000101
  • CVE-2017-7407

openssl:

  • CVE-2016-2105
  • CVE-2016-2106
  • CVE-2016-2107
  • CVE-2016-2108
  • CVE-2016-2109
  • CVE-2016-2177
  • CVE-2016-2178
  • CVE-2016-2179
  • CVE-2016-2180
  • CVE-2016-2181
  • CVE-2016-2182
  • CVE-2016-2183
  • CVE-2016-6302
  • CVE-2016-6303
  • CVE-2016-6304
  • CVE-2016-6306

libxml2:

  • CVE-2014-0191
  • CVE-2015-8806
  • CVE-2016-1762
  • CVE-2016-1833
  • CVE-2016-1834
  • CVE-2016-1835
  • CVE-2016-1837
  • CVE-2016-1838
  • CVE-2016-1839
  • CVE-2016-1840
  • CVE-2016-2073
  • CVE-2016-3627
  • CVE-2016-3705
  • CVE-2016-4447
  • CVE-2016-4448
  • CVE-2016-4449
  • CVE-2016-4483
  • CVE-2016-4658
  • CVE-2016-9318
  • CVE-2016-9597
  • CVE-2017-9047
  • CVE-2017-9048
  • CVE-2017-9049
  • CVE-2017-9050

util-linux:

  • CVE-2015-5218
  • CVE-2016-5011
  • CVE-2017-2616

cracklib:

  • CVE-2016-6318

systemd:

  • CVE-2014-9770
  • CVE-2015-8842
  • CVE-2016-7796

pcre:

  • CVE-2014-8964
  • CVE-2015-2325
  • CVE-2015-2327
  • CVE-2015-2328
  • CVE-2015-3210
  • CVE-2015-3217
  • CVE-2015-5073
  • CVE-2015-8380
  • CVE-2015-8381
  • CVE-2015-8382
  • CVE-2015-8383
  • CVE-2015-8384
  • CVE-2015-8385
  • CVE-2015-8386
  • CVE-2015-8387
  • CVE-2015-8388
  • CVE-2015-8389
  • CVE-2015-8390
  • CVE-2015-8391
  • CVE-2015-8392
  • CVE-2015-8393
  • CVE-2015-8394
  • CVE-2015-8395
  • CVE-2016-1283
  • CVE-2016-3191

appamor:

  • CVE-2017-6507

bash:

  • CVE-2014-6277
  • CVE-2014-6278
  • CVE-2016-0634
  • CVE-2016-7543

cpio:

  • CVE-2016-2037

glibc:

  • CVE-2016-1234
  • CVE-2016-3075
  • CVE-2016-3706
  • CVE-2016-4429
  • CVE-2017-1000366

perl:

  • CVE-2015-8853
  • CVE-2016-1238
  • CVE-2016-2381
  • CVE-2016-6185

libssh2_org:

  • CVE-2016-0787

expat:

  • CVE-2012-6702
  • CVE-2015-1283
  • CVE-2016-0718
  • CVE-2016-5300
  • CVE-2016-9063
  • CVE-2017-9233

ncurses:

  • CVE-2017-10684
  • CVE-2017-10685
  • CVE-2017-11112
  • CVE-2017-11113

libksba:

  • CVE-2016-4574
  • CVE-2016-4579

libgcrypt:

  • CVE-2015-7511
  • CVE-2016-6313
  • CVE-2017-7526

dbus-1:

  • CVE-2014-7824
  • CVE-2015-0245

Finally, the following packages received non-security fixes:

  • augeas
  • bzip2
  • ca-certificates-mozilla
  • coreutils
  • cryptsetup
  • cyrus-sasl
  • dirmngr
  • e2fsprogs
  • findutils
  • gpg2
  • insserv-compat
  • kmod
  • libcap
  • libsolv
  • libzypp
  • openldap2
  • p11-kit
  • permissions
  • procps
  • rpm
  • sed
  • shadow
  • zypper
Record
SUSE-SU-2017:2699-1
Updated
2026-11-02
OSVSUSE-SU-2017:2700-1 No score

Security update for SLES 12-SP1 Docker image

The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

  • Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
  • Do not install recommended packages when building container images. (bsc#975726)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE cross-reference is available below.

pam:

  • CVE-2015-3238

libtasn1:

  • CVE-2015-3622
  • CVE-2016-4008

expat:

expat:

  • CVE-2012-6702
  • CVE-2015-1283
  • CVE-2016-0718
  • CVE-2016-5300
  • CVE-2016-9063
  • CVE-2017-9233

libidn:

  • CVE-2015-2059
  • CVE-2015-8948
  • CVE-2016-6261
  • CVE-2016-6262
  • CVE-2016-6263

zlib:

  • CVE-2016-9840
  • CVE-2016-9841
  • CVE-2016-9842
  • CVE-2016-9843

curl:

  • CVE-2016-5419
  • CVE-2016-5420
  • CVE-2016-5421
  • CVE-2016-7141
  • CVE-2016-7167
  • CVE-2016-8615
  • CVE-2016-8616
  • CVE-2016-8617
  • CVE-2016-8618
  • CVE-2016-8619
  • CVE-2016-8620
  • CVE-2016-8621
  • CVE-2016-8622
  • CVE-2016-8623
  • CVE-2016-8624
  • CVE-2016-9586
  • CVE-2017-1000100
  • CVE-2017-1000101
  • CVE-2017-7407

openssl:

  • CVE-2016-2105
  • CVE-2016-2106
  • CVE-2016-2107
  • CVE-2016-2108
  • CVE-2016-2109
  • CVE-2016-2177
  • CVE-2016-2178
  • CVE-2016-2179
  • CVE-2016-2180
  • CVE-2016-2181
  • CVE-2016-2182
  • CVE-2016-2183
  • CVE-2016-6302
  • CVE-2016-6303
  • CVE-2016-6304
  • CVE-2016-6306
  • CVE-2016-7056
  • CVE-2016-8610
  • CVE-2017-3731

cracklib:

  • CVE-2016-6318

pcre:

  • CVE-2014-8964
  • CVE-2015-2325
  • CVE-2015-2327
  • CVE-2015-2328
  • CVE-2015-3210
  • CVE-2015-3217
  • CVE-2015-5073
  • CVE-2015-8380
  • CVE-2015-8381
  • CVE-2015-8382
  • CVE-2015-8383
  • CVE-2015-8384
  • CVE-2015-8385
  • CVE-2015-8386
  • CVE-2015-8387
  • CVE-2015-8388
  • CVE-2015-8389
  • CVE-2015-8390
  • CVE-2015-8391
  • CVE-2015-8392
  • CVE-2015-8393
  • CVE-2015-8394
  • CVE-2015-8395
  • CVE-2016-1283
  • CVE-2016-3191

appamor:

  • CVE-2017-6507

bash:

  • CVE-2014-6277
  • CVE-2014-6278
  • CVE-2016-0634
  • CVE-2016-7543

cpio:

  • CVE-2016-2037

glibc:

  • CVE-2016-1234
  • CVE-2016-3075
  • CVE-2016-3706
  • CVE-2016-4429
  • CVE-2017-1000366

perl:

  • CVE-2015-8853
  • CVE-2016-1238
  • CVE-2016-2381
  • CVE-2016-6185

libssh2_org:

  • CVE-2016-0787

util-linux:

  • CVE-2016-5011
  • CVE-2017-2616

ncurses:

  • CVE-2017-10684
  • CVE-2017-10685
  • CVE-2017-11112
  • CVE-2017-11113

libksba:

  • CVE-2016-4574
  • CVE-2016-4579

libxml2:

  • CVE-2014-0191
  • CVE-2015-8806
  • CVE-2016-1762
  • CVE-2016-1833
  • CVE-2016-1834
  • CVE-2016-1835
  • CVE-2016-1837
  • CVE-2016-1838
  • CVE-2016-1839
  • CVE-2016-1840
  • CVE-2016-2073
  • CVE-2016-3627
  • CVE-2016-3705
  • CVE-2016-4447
  • CVE-2016-4448
  • CVE-2016-4449
  • CVE-2016-4483
  • CVE-2016-4658
  • CVE-2016-9318
  • CVE-2016-9597
  • CVE-2017-9047
  • CVE-2017-9048
  • CVE-2017-9049
  • CVE-2017-9050

libgcrypt:

  • CVE-2015-7511
  • CVE-2016-6313
  • CVE-2017-7526

update-alternatives:

  • CVE-2015-0860

systemd:

  • CVE-2014-9770
  • CVE-2015-8842
  • CVE-2016-7796

dbus-1:

  • CVE-2014-7824
  • CVE-2015-0245

Finally, the following packages received non-security fixes:

  • augeas
  • bzip2
  • ca-certificates-mozilla
  • coreutils
  • cryptsetup
  • cyrus-sasl
  • dirmngr
  • e2fsprogs
  • findutils
  • gpg2
  • insserv-compat
  • kmod
  • libcap
  • libsolv
  • libzypp
  • lua51
  • lvm2
  • netcfg
  • p11-kit
  • permissions
  • procps
  • rpm
  • sed
  • sg3_utils
  • shadow
  • zypper
Record
SUSE-SU-2017:2700-1
Updated
2026-11-02
OSVUSN-3123-1 No score

curl vulnerabilities

It was discovered that curl incorrectly reused client certificates when built with NSS. A remote attacker could possibly use this issue to hijack the authentication of a TLS connection. (CVE-2016-7141)

Nguyen Vu Hoang discovered that curl incorrectly handled escaping certain strings. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7167)

It was discovered that curl incorrectly handled storing cookies. A remote attacker could possibly use this issue to inject cookies for arbitrary domains in the cookie jar. (CVE-2016-8615)

It was discovered that curl incorrect handled case when comparing user names and passwords. A remote attacker with knowledge of a case-insensitive version of the correct password could possibly use this issue to cause a connection to be reused. (CVE-2016-8616)

It was discovered that curl incorrect handled memory when encoding to base64. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-8617)

It was discovered that curl incorrect handled memory when preparing formatted output. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-8618)

It was discovered that curl incorrect handled memory when performing Kerberos authentication. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-8619)

Luật Nguyễn discovered that curl incorrectly handled parsing globs. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-8620)

Luật Nguyễn discovered that curl incorrectly handled converting dates. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service. (CVE-2016-8621)

It was discovered that curl incorrectly handled URL percent-encoding decoding. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-8622)

It was discovered that curl incorrectly handled shared cookies. A remote server could possibly obtain incorrect cookies or other sensitive information. (CVE-2016-8623)

Fernando Muñoz discovered that curl incorrect parsed certain URLs. A remote attacker could possibly use this issue to trick curl into connecting to a different host. (CVE-2016-8624)

Record
USN-3123-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Alpine:v3.10
 before 7.51.0-r0
7.51.0-r0
curl
Alpine:v3.11
 before 7.51.0
7.51.0
curl
Alpine:v3.12
 before 7.51.0-r0
7.51.0-r0
curl
Alpine:v3.13
 before 7.51.0-r0
7.51.0-r0
curl
Alpine:v3.14
 before 7.51.0-r0
7.51.0-r0
curl
Alpine:v3.15
 before 7.51.0-r0
7.51.0-r0
curl
Alpine:v3.16
 before 7.51.0-r0
7.51.0-r0
curl
Alpine:v3.17
 before 7.51.0-r0
7.51.0-r0
curl
Alpine:v3.18
 before 7.51.0-r0
7.51.0-r0
curl
Alpine:v3.19
 before 7.51.0-r0
7.51.0-r0
Show 74 moreShow less
Affected packages
PackageAffectedFixed
curl
Alpine:v3.2
 before 7.49.1-r4
7.49.1-r4
curl
Alpine:v3.20
 before 7.51.0-r0
7.51.0-r0
curl
Alpine:v3.21
 before 7.51.0-r0
7.51.0-r0
curl
Alpine:v3.22
 before 7.51.0-r0
7.51.0-r0
curl
Alpine:v3.23
 before 7.51.0-r0
7.51.0-r0
curl
Alpine:v3.24
 before 7.51.0-r0
7.51.0-r0
curl
Alpine:v3.3
 before 7.49.1-r4
7.49.1-r4
curl
Alpine:v3.4
 before 7.51.0-r0
7.51.0-r0
curl
Alpine:v3.5
 before 7.51.0-r0
7.51.0-r0
curl
Alpine:v3.6
 before 7.51.0
7.51.0
curl
Alpine:v3.7
 before 7.51.0
7.51.0
curl
Alpine:v3.8
 before 7.51.0
7.51.0
curl
Alpine:v3.9
 before 7.51.0-r0
7.51.0-r0
curl
TuxCare:CentOS:6
From an advisory covering 2 CVEs
 before 7.19.7-59.el6.tuxcare.els13
7.19.7-59.el6.tuxcare.els13
libcurl
TuxCare:CentOS:6
From an advisory covering 2 CVEs
 before 7.19.7-59.el6.tuxcare.els13
7.19.7-59.el6.tuxcare.els13
libcurl-devel
TuxCare:CentOS:6
From an advisory covering 2 CVEs
 before 7.19.7-59.el6.tuxcare.els13
7.19.7-59.el6.tuxcare.els13
curl
TuxCare:OracleLinux:6
From an advisory covering 2 CVEs
 before 7.19.7-59.el6.tuxcare.els13
7.19.7-59.el6.tuxcare.els13
libcurl
TuxCare:OracleLinux:6
From an advisory covering 2 CVEs
 before 7.19.7-59.el6.tuxcare.els13
7.19.7-59.el6.tuxcare.els13
libcurl-devel
TuxCare:OracleLinux:6
From an advisory covering 2 CVEs
 before 7.19.7-59.el6.tuxcare.els13
7.19.7-59.el6.tuxcare.els13
curl
Debian:12
 before 7.51.0-1
7.51.0-1
curl
Debian:13
 before 7.51.0-1
7.51.0-1
curl
Debian:14
 before 7.51.0-1
7.51.0-1
curl
Debian:7
From an advisory covering 9 CVEs
 before 7.26.0-1+wheezy17, plus listed versions
7.26.0-1+wheezy107.26.0-1+wheezy117.26.0-1+wheezy127.26.0-1+wheezy137.26.0-1+wheezy14
Show 10 moreShow less
7.26.0-1+wheezy157.26.0-1+wheezy167.26.0-1+wheezy27.26.0-1+wheezy37.26.0-1+wheezy47.26.0-1+wheezy57.26.0-1+wheezy67.26.0-1+wheezy77.26.0-1+wheezy87.26.0-1+wheezy9
7.26.0-1+wheezy17
curl
Debian:8
From an advisory covering 10 CVEs
 before 7.38.0-4+deb8u5, plus listed versions
7.38.0-47.38.0-4+deb8u17.38.0-4+deb8u27.38.0-4+deb8u37.38.0-4+deb8u4
7.38.0-4+deb8u5
curl
Mageia:5
From an advisory covering 18 CVEs
 before 7.40.0-3.14.mga5
7.40.0-3.14.mga5
httpd24-curl
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:7.61.1-1.el6
0:7.61.1-1.el6
httpd24-curl-debuginfo
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:7.61.1-1.el6
0:7.61.1-1.el6
httpd24-httpd
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el6
0:2.4.34-7.el6
httpd24-httpd-debuginfo
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el6
0:2.4.34-7.el6
httpd24-httpd-devel
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el6
0:2.4.34-7.el6
httpd24-httpd-manual
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el6
0:2.4.34-7.el6
httpd24-httpd-tools
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el6
0:2.4.34-7.el6
httpd24-libcurl
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:7.61.1-1.el6
0:7.61.1-1.el6
httpd24-libcurl-devel
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:7.61.1-1.el6
0:7.61.1-1.el6
httpd24-libnghttp2
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:1.7.1-7.el6
0:1.7.1-7.el6
httpd24-libnghttp2-devel
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:1.7.1-7.el6
0:1.7.1-7.el6
httpd24-mod_ldap
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el6
0:2.4.34-7.el6
httpd24-mod_proxy_html
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 1:2.4.34-7.el6
1:2.4.34-7.el6
httpd24-mod_session
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el6
0:2.4.34-7.el6
httpd24-mod_ssl
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 1:2.4.34-7.el6
1:2.4.34-7.el6
httpd24-nghttp2
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:1.7.1-7.el6
0:1.7.1-7.el6
httpd24-nghttp2-debuginfo
Red Hat:rhel_software_collections:3::el6
From an advisory covering 38 CVEs
 before 0:1.7.1-7.el6
0:1.7.1-7.el6
httpd24-curl
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:7.61.1-1.el7
0:7.61.1-1.el7
httpd24-curl-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:7.61.1-1.el7
0:7.61.1-1.el7
httpd24-httpd
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el7
0:2.4.34-7.el7
httpd24-httpd-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el7
0:2.4.34-7.el7
httpd24-httpd-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el7
0:2.4.34-7.el7
httpd24-httpd-manual
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el7
0:2.4.34-7.el7
httpd24-httpd-tools
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el7
0:2.4.34-7.el7
httpd24-libcurl
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:7.61.1-1.el7
0:7.61.1-1.el7
httpd24-libcurl-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:7.61.1-1.el7
0:7.61.1-1.el7
httpd24-libnghttp2
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:1.7.1-7.el7
0:1.7.1-7.el7
httpd24-libnghttp2-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:1.7.1-7.el7
0:1.7.1-7.el7
httpd24-mod_ldap
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el7
0:2.4.34-7.el7
httpd24-mod_md
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el7
0:2.4.34-7.el7
httpd24-mod_proxy_html
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 1:2.4.34-7.el7
1:2.4.34-7.el7
httpd24-mod_session
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:2.4.34-7.el7
0:2.4.34-7.el7
httpd24-mod_ssl
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 1:2.4.34-7.el7
1:2.4.34-7.el7
httpd24-nghttp2
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:1.7.1-7.el7
0:1.7.1-7.el7
httpd24-nghttp2-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 38 CVEs
 before 0:1.7.1-7.el7
0:1.7.1-7.el7
curl
SUSE:Linux Enterprise Desktop 12 SP1
From an advisory covering 11 CVEs
 before 7.37.0-31.1
7.37.0-31.1
curl
SUSE:Linux Enterprise Software Development Kit 12 SP1
From an advisory covering 11 CVEs
 before 7.37.0-31.1
7.37.0-31.1
curl
SUSE:Linux Enterprise Server 12 SP1
From an advisory covering 11 CVEs
 before 7.37.0-31.1
7.37.0-31.1
curl
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 11 CVEs
 before 7.37.0-31.1
7.37.0-31.1
curl
SUSE:Studio Onsite 1.3
From an advisory covering 13 CVEs
 before 7.19.7-1.20.47.2
7.19.7-1.20.47.2
curl
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 11 CVEs
 before 7.19.7-1.64.1
7.19.7-1.64.1
curl-openssl1
SUSE:Linux Enterprise Server 11-SECURITY
From an advisory covering 11 CVEs
 before 7.19.7-1.64.1
7.19.7-1.64.1
curl
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 11 CVEs
 before 7.19.7-1.64.1
7.19.7-1.64.1
curl
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 11 CVEs
 before 7.19.7-1.64.1
7.19.7-1.64.1
curl
Ubuntu:14.04:LTS
 before 7.35.0-1ubuntu2.10, plus listed versions
7.32.0-1ubuntu17.33.0-1ubuntu17.34.0-1ubuntu17.35.0-1ubuntu17.35.0-1ubuntu2
Show 8 moreShow less
7.35.0-1ubuntu2.17.35.0-1ubuntu2.27.35.0-1ubuntu2.37.35.0-1ubuntu2.57.35.0-1ubuntu2.67.35.0-1ubuntu2.77.35.0-1ubuntu2.87.35.0-1ubuntu2.9
7.35.0-1ubuntu2.10
curl
Ubuntu:16.04:LTS
 before 7.47.0-1ubuntu2.2, plus listed versions
7.43.0-1ubuntu27.45.0-1ubuntu17.46.0-1ubuntu17.47.0-1ubuntu17.47.0-1ubuntu27.47.0-1ubuntu2.1
7.47.0-1ubuntu2.2
curl
Ubuntu:14.04:LTS
From an advisory covering 12 CVEs
 before 7.35.0-1ubuntu2.10, plus listed versions
7.32.0-1ubuntu17.33.0-1ubuntu17.34.0-1ubuntu17.35.0-1ubuntu17.35.0-1ubuntu2
Show 8 moreShow less
7.35.0-1ubuntu2.17.35.0-1ubuntu2.27.35.0-1ubuntu2.37.35.0-1ubuntu2.57.35.0-1ubuntu2.67.35.0-1ubuntu2.77.35.0-1ubuntu2.87.35.0-1ubuntu2.9
7.35.0-1ubuntu2.10
curl
Ubuntu:16.04:LTS
From an advisory covering 12 CVEs
 before 7.47.0-1ubuntu2.2, plus listed versions
7.43.0-1ubuntu27.45.0-1ubuntu17.46.0-1ubuntu17.47.0-1ubuntu17.47.0-1ubuntu27.47.0-1ubuntu2.1
7.47.0-1ubuntu2.2
curl
openSUSE:Tumbleweed
From an advisory covering 32 CVEs
 before 7.51.0-1.1
7.51.0-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-8615 is a medium vulnerability (CVSS 5.3) in Curl, published November 2, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.72%, the 91st percentile. Fixed in curl 7.51.0-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 213 references and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open