{"id":"CVE-2015-3143","aliases":["CURL-CVE-2015-3143","DEBIAN-CVE-2015-3143","DLA-211-1","DSA-3232-1","EUVD-2015-3224","GHSA-6mxf-77w3-cj5m","MGASA-2015-0179","RHSA-2015:1254","RHSA-2015:2159","SUSE-SU-2015:0962-1","SUSE-SU-2015:0990-1","UBUNTU-CVE-2015-3143","USN-2591-1","openSUSE-SU-2024:10303-1"],"status":"published","title":"cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows...","description":"cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.11149,"percentile":0.95972,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2014-04-15T15:50:15Z","modified":"2026-10-24T23:17:46Z","fixes":[{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.42.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.42.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.42.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"curl","fixed_in":["7.35.0-1ubuntu2.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.42.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.42.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.42.0-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.21.0-2.1+squeeze12"}]}],"versions":["7.21.0-1","7.21.0-2","7.21.0-2.1+squeeze1","7.21.0-2.1+squeeze10","7.21.0-2.1+squeeze11","7.21.0-2.1+squeeze2","7.21.0-2.1+squeeze3","7.21.0-2.1+squeeze4","7.21.0-2.1+squeeze5","7.21.0-2.1+squeeze6","7.21.0-2.1+squeeze7","7.21.0-2.1+squeeze8","7.21.0-2.1+squeeze9"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.26.0-1+wheezy13"}]}],"versions":["7.26.0-1+wheezy10","7.26.0-1+wheezy11","7.26.0-1+wheezy12","7.26.0-1+wheezy2","7.26.0-1+wheezy3","7.26.0-1+wheezy4","7.26.0-1+wheezy5","7.26.0-1+wheezy6","7.26.0-1+wheezy7","7.26.0-1+wheezy8","7.26.0-1+wheezy9"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.38.0-4+deb8u1"}]}],"versions":["7.38.0-4"],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.34.0-1.6.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.5"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.5"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.51.0-1.1"}]}],"bundled":32}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"haxx","product":"curl"},{"vendor":"haxx","product":"libcurl"},{"vendor":"hp","product":"system_management_homepage"}],"references":[{"url":"http://marc.info/?l=bugtraq\u0026m=145612005512270\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://curl.haxx.se/docs/adv_20150422A.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"http://www.debian.org/security/2015/dsa-3232","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156250.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:219","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2591-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.securitytracker.com/id/1032232","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/74299","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1254.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:220","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10743","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://advisories.mageia.org/MGASA-2015-0179.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://support.apple.com/kb/HT205031","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201509-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3143","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6mxf-77w3-cj5m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3143","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0179.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15746","tags":["report"]},{"url":"http://curl.haxx.se/docs/adv_20150422D.html","tags":["web"]},{"url":"http://curl.haxx.se/docs/adv_20150422B.html","tags":["web","article"]},{"url":"https://www.debian.org/security/2015/dsa-3232","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1254","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=835898","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=883002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=997185","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1008178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1011083","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1011101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1058767","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1104160","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1136154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154059","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154747","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1156422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1168137","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1178692","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213351","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1254.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3613","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3613","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3613","tags":["advisory"]},{"url":"http://curl.haxx.se/docs/adv_20140910A.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3707","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3707","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3707","tags":["advisory"]},{"url":"http://curl.haxx.se/docs/adv_20141105.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8150","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8150","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8150","tags":["advisory"]},{"url":"http://curl.haxx.se/docs/adv_20150108B.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3143","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3148","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:2159","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1130239","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154060","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161182","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1166264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1218272","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2159.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150962-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/824517","tags":["report"]},{"url":"https://bugzilla.suse.com/849596","tags":["report"]},{"url":"https://bugzilla.suse.com/858673","tags":["report"]},{"url":"https://bugzilla.suse.com/868627","tags":["report"]},{"url":"https://bugzilla.suse.com/868629","tags":["report"]},{"url":"https://bugzilla.suse.com/870444","tags":["report"]},{"url":"https://bugzilla.suse.com/927174","tags":["report"]},{"url":"https://bugzilla.suse.com/927556","tags":["report"]},{"url":"https://bugzilla.suse.com/927746","tags":["report"]},{"url":"https://bugzilla.suse.com/928533","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3153","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150990-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/927607","tags":["report"]},{"url":"https://bugzilla.suse.com/927608","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3145","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-3143","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2591-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-3144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3153","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8625","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-3143","description":"cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.","status":"published","published":"2015-04-24T14:00:00Z","modified":"2024-08-06T05:39:31.921Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3224","description":"cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.","status":"published","published":"2015-04-24T14:00:00Z","modified":"2024-08-06T05:39:31Z","updated_at":"2026-11-03T02:22:09.179399Z"}],"ghsa":[{"id":"GHSA-6mxf-77w3-cj5m","title":"cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows...","description":"cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.","status":"published","published":"2022-05-14T03:59:13Z","modified":"2023-02-03T05:00:57Z","updated_at":"2026-11-02T14:52:53.034472Z"}],"nvd":[{"id":"CVE-2015-3143","description":"cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.","status":"published","published":"2015-04-24T14:59:08.187Z","modified":"2026-06-17T00:25:22.87Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:04.095849Z"}],"osv":[{"id":"CURL-CVE-2015-3143","title":"Reusing authenticated connection when unauthenticated","description":"libcurl keeps a pool of its last few connections around after use to\nfacilitate easy, convenient and completely transparent connection reuse for\napplications.\n\nWhen doing HTTP requests NTLM authenticated, the entire connection becomes\nauthenticated and not only the specific HTTP request which is otherwise how\nHTTP works. This makes NTLM special and a subject for special treatment in the\ncode. With NTLM, once the connection is authenticated, no further\nauthentication is necessary until the connection gets closed.\n\nlibcurl's connection reuse logic selects an existing connection for reuse\nwhen asked to do a request, and when asked to use NTLM libcurl have to pick a\nconnection with matching credentials only.\n\nIf a connection was first setup and used for an NTLM HTTP request with a\nspecific set of credentials, that same connection could later wrongly get\nreused in a subsequent HTTP request that was made to the same host - but\nwithout having any credentials set! Since an NTLM connection was already\nauthenticated due to how NTLM works, the subsequent request could then get\nsent over the wrong connection appearing as the initial user.\n\nThis problem is similar to the previous problem known as\n[CVE-2014-0015](https://curl.se/docs/CVE-2014-0015.html). The main difference\nthis time is that the subsequent request that wrongly reuse a connection does\nnot ask for NTLM authentication.","status":"published","published":"2015-04-22T08:00:00Z","modified":"2026-10-24T23:17:46Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CVE-2015-3143","description":"cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.","status":"published","published":"2015-04-24T14:59:08Z","modified":"2026-04-16T06:19:37.638167071Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3143","description":"cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.","status":"published","published":"2015-04-24T14:59:08.187Z","modified":"2026-09-09T06:47:30.701473469Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DLA-211-1","title":"curl - security update","status":"published","published":"2015-04-29T00:00:00Z","modified":"2026-03-09T01:18:35.203574Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-3232-1","title":"curl - security update","status":"published","published":"2015-04-22T00:00:00Z","modified":"2026-03-09T01:21:10.574364Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0179","title":"Updated curl packages fix security vulnerabilities","description":"Updated curl packages fix security vulnerabilities:\n\nNTLM-authenticated connections could be wrongly reused for requests without\nany credentials set, leading to HTTP requests being sent over the connection\nauthenticated as a different user (CVE-2015-3143).\n\nWhen parsing HTTP cookies, if the parsed cookie's \"path\" element consists of a\nsingle double-quote, libcurl would try to write to an invalid heap memory\naddress. This could allow remote attackers to cause a denial of service\n(crash) (CVE-2015-3145).\n\nWhen doing HTTP requests using the Negotiate authentication method along with\nNTLM, the connection used would not be marked as authenticated, making it\npossible to reuse it and send requests for one user over the connection\nauthenticated as a different user (CVE-2015-3148).\n","status":"published","published":"2015-05-03T00:19:16Z","modified":"2026-04-16T06:25:40.439440803Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10303-1","title":"curl-7.51.0-1.1 on GA media","description":"These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:23.860668Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2015:1254","title":"Red Hat Security Advisory: curl security, bug fix, and enhancement update","status":"published","published":"2024-09-15T22:15:39Z","modified":"2026-06-28T10:14:15Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:2159","title":"Red Hat Security Advisory: curl security, bug fix, and enhancement update","status":"published","published":"2024-09-15T22:15:45Z","modified":"2026-06-28T10:15:11Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"SUSE-SU-2015:0962-1","title":"Security update for curl","description":"\nThis curl update fixes the following security issues:\n\n    * bnc#868627: wrong re-use of connections (CVE-2014-0138).\n    * bnc#868629: IP address wildcard certificate validation\n      (CVE-2014-0139).\n    * bnc#870444: --insecure option inappropriately enforcing security\n      safeguard.\n\nSecurity Issue references:\n\n    * CVE-2014-0138\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138\u003e\n    * CVE-2014-0139\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0139\u003e\n\n","status":"published","published":"2014-04-15T15:50:15Z","modified":"2026-02-04T03:17:15.082145Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0990-1","title":"Security update for curl","description":"curl was updated to fix five security issues.\n\nThe following vulnerabilities were fixed:\n\n* CVE-2015-3143: curl could re-use NTML authenticateds connections\n* CVE-2015-3144: curl could access memory out of bounds with zero length host names\n* CVE-2015-3145: curl cookie parser could access memory out of boundary\n* CVE-2015-3148: curl could treat Negotiate as not connection-oriented\n* CVE-2015-3153: curl could have sent sensitive HTTP headers also to proxies\n","status":"published","published":"2015-04-29T18:22:39Z","modified":"2026-02-04T02:50:41.558883Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2015-3143","description":"cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.","status":"published","published":"2015-04-22T00:00:00Z","modified":"2026-04-22T10:06:08.203259Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2591-1","title":"curl vulnerabilities","description":"Paras Sethia discovered that curl could incorrectly re-use NTLM HTTP\ncredentials when subsequently connecting to the same host over HTTP.\n(CVE-2015-3143)\n\nHanno Böck discovered that curl incorrectly handled zero-length host names.\nIf a user or automated system were tricked into using a specially crafted\nhost name, an attacker could possibly use this issue to cause curl to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 14.10 and Ubuntu 15.04.\n(CVE-2015-3144)\n\nHanno Böck discovered that curl incorrectly handled cookie path elements.\nIf a user or automated system were tricked into parsing a specially crafted\ncookie, an attacker could possibly use this issue to cause curl to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04.\n(CVE-2015-3145)\n\nIsaac Boukris discovered that when using Negotiate authenticated\nconnections, curl could incorrectly authenticate the entire connection and\nnot just specific HTTP requests. (CVE-2015-3148)\n\nYehezkel Horowitz and Oren Souroujon discovered that curl sent HTTP headers\nboth to servers and proxies by default, contrary to expectations. This\nissue only affected Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-3153)\n","status":"published","published":"2015-04-30T13:27:57Z","modified":"2026-04-22T09:11:24.986541Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}