{"id":"CVE-2015-3145","aliases":["CURL-CVE-2015-3145","DEBIAN-CVE-2015-3145","EUVD-2015-3226","GHSA-c7m9-x5vw-4grr","MGASA-2015-0179","SUSE-SU-2015:0990-1","UBUNTU-CVE-2015-3145","USN-2591-1","openSUSE-SU-2024:10303-1"],"status":"published","title":"The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly...","description":"The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.30467,"percentile":0.98248,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2015-04-22T00:00:00Z","modified":"2026-10-25T01:05:30Z","fixes":[{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.42.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.42.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.42.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"curl","fixed_in":["7.35.0-1ubuntu2.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.42.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.42.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.42.0-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.34.0-1.6.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.5"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.5"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.51.0-1.1"}]}],"bundled":32}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"haxx","product":"curl"},{"vendor":"haxx","product":"libcurl"},{"vendor":"hp","product":"system_management_homepage"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"oracle","product":"solaris"}],"references":[{"url":"http://www.securityfocus.com/bid/74303","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3232","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://curl.haxx.se/docs/adv_20150422C.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156250.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:219","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2591-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1032232","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10743","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://advisories.mageia.org/MGASA-2015-0179.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.apple.com/kb/HT205031","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201509-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3145"},{"url":"https://github.com/advisories/GHSA-c7m9-x5vw-4grr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3145","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0179.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15746","tags":["report"]},{"url":"http://curl.haxx.se/docs/adv_20150422A.html","tags":["web"]},{"url":"http://curl.haxx.se/docs/adv_20150422D.html","tags":["web"]},{"url":"http://curl.haxx.se/docs/adv_20150422B.html","tags":["web"]},{"url":"https://www.debian.org/security/2015/dsa-3232","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150990-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/927556","tags":["report"]},{"url":"https://bugzilla.suse.com/927607","tags":["report"]},{"url":"https://bugzilla.suse.com/927608","tags":["report"]},{"url":"https://bugzilla.suse.com/927746","tags":["report"]},{"url":"https://bugzilla.suse.com/928533","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3153","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-3145","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2591-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3153","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8625","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-3145","description":"The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.","status":"published","published":"2015-04-24T14:00:00Z","modified":"2024-08-06T05:39:30.959Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3226","description":"The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.","status":"published","published":"2015-04-24T14:00:00Z","modified":"2024-08-06T05:39:30Z","updated_at":"2026-11-03T02:22:09.179399Z"}],"ghsa":[{"id":"GHSA-c7m9-x5vw-4grr","title":"The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly...","description":"The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.","status":"published","published":"2022-05-14T02:06:53Z","modified":"2023-02-02T05:05:09Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:52:01.981409Z"}],"nvd":[{"id":"CVE-2015-3145","description":"The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.","status":"published","published":"2015-04-24T14:59:10.157Z","modified":"2026-06-17T00:25:23.22Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:04.095849Z"}],"osv":[{"id":"CURL-CVE-2015-3145","title":"cookie parser out of boundary memory access","description":"libcurl supports HTTP \"cookies\" as documented in RFC 6265. Together with each\nindividual cookie there are several different properties, but for this\nvulnerability we focus on the associated \"path\" element. It tells information\nabout for which path on a given host the cookie is valid.\n\nThe internal libcurl function called `sanitize_cookie_path()` that cleans up\nthe path element as given to it from a remote site or when read from a file,\ndid not properly validate the input. If given a path that consisted of a\nsingle double-quote, libcurl would index a newly allocated memory area with\nindex -1 and assign a zero to it, thus destroying heap memory it was not\nsupposed to.\n\nAt best, this gets unnoticed but can also lead to a crash or worse. We have\nnot researched further what kind of malicious actions that potentially this\ncould be used for.\n\nApplications have to explicitly enable cookie parsing in libcurl for this\nproblem to trigger, and if not enabled libcurl does not hit this problem.","status":"published","published":"2015-04-22T08:00:00Z","modified":"2026-10-25T01:05:30.172506486Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CVE-2015-3145","description":"The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.","status":"published","published":"2015-04-24T14:59:10Z","modified":"2026-04-16T06:16:59.543644567Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3145","description":"The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.","status":"published","published":"2015-04-24T14:59:10.157Z","modified":"2026-09-09T06:47:19.171516874Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"MGASA-2015-0179","title":"Updated curl packages fix security vulnerabilities","description":"Updated curl packages fix security vulnerabilities:\n\nNTLM-authenticated connections could be wrongly reused for requests without\nany credentials set, leading to HTTP requests being sent over the connection\nauthenticated as a different user (CVE-2015-3143).\n\nWhen parsing HTTP cookies, if the parsed cookie's \"path\" element consists of a\nsingle double-quote, libcurl would try to write to an invalid heap memory\naddress. This could allow remote attackers to cause a denial of service\n(crash) (CVE-2015-3145).\n\nWhen doing HTTP requests using the Negotiate authentication method along with\nNTLM, the connection used would not be marked as authenticated, making it\npossible to reuse it and send requests for one user over the connection\nauthenticated as a different user (CVE-2015-3148).\n","status":"published","published":"2015-05-03T00:19:16Z","modified":"2026-04-16T06:25:40.439440803Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10303-1","title":"curl-7.51.0-1.1 on GA media","description":"These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:23.860668Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2015:0990-1","title":"Security update for curl","description":"curl was updated to fix five security issues.\n\nThe following vulnerabilities were fixed:\n\n* CVE-2015-3143: curl could re-use NTML authenticateds connections\n* CVE-2015-3144: curl could access memory out of bounds with zero length host names\n* CVE-2015-3145: curl cookie parser could access memory out of boundary\n* CVE-2015-3148: curl could treat Negotiate as not connection-oriented\n* CVE-2015-3153: curl could have sent sensitive HTTP headers also to proxies\n","status":"published","published":"2015-04-29T18:22:39Z","modified":"2026-02-04T02:50:41.558883Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2015-3145","description":"The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.","status":"published","published":"2015-04-22T00:00:00Z","modified":"2026-04-22T10:07:00.148104Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2591-1","title":"curl vulnerabilities","description":"Paras Sethia discovered that curl could incorrectly re-use NTLM HTTP\ncredentials when subsequently connecting to the same host over HTTP.\n(CVE-2015-3143)\n\nHanno Böck discovered that curl incorrectly handled zero-length host names.\nIf a user or automated system were tricked into using a specially crafted\nhost name, an attacker could possibly use this issue to cause curl to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 14.10 and Ubuntu 15.04.\n(CVE-2015-3144)\n\nHanno Böck discovered that curl incorrectly handled cookie path elements.\nIf a user or automated system were tricked into parsing a specially crafted\ncookie, an attacker could possibly use this issue to cause curl to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04.\n(CVE-2015-3145)\n\nIsaac Boukris discovered that when using Negotiate authenticated\nconnections, curl could incorrectly authenticate the entire connection and\nnot just specific HTTP requests. (CVE-2015-3148)\n\nYehezkel Horowitz and Oren Souroujon discovered that curl sent HTTP headers\nboth to servers and proxies by default, contrary to expectations. This\nissue only affected Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-3153)\n","status":"published","published":"2015-04-30T13:27:57Z","modified":"2026-04-22T09:11:24.986541Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}