{"id":"CVE-2016-5421","aliases":["ALPINE-CVE-2016-5421","BELL-CVE-2016-5421","CURL-CVE-2016-5421","DEBIAN-CVE-2016-5421","DSA-3638-1","EUVD-2016-6366","GHSA-89f8-gvcm-9g9g","MGASA-2016-0285","RHSA-2018:3558","SUSE-SU-2016:2330-1","SUSE-SU-2017:2699-1","SUSE-SU-2017:2700-1","UBUNTU-CVE-2016-5421","USN-3048-1"],"status":"published","title":"Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which...","description":"Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.08037,"percentile":0.94816,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2016-08-03T00:00:00Z","modified":"2026-10-24T23:17:46Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"curl","fixed_in":["7.50.1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.2","package":"curl","fixed_in":["7.49.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"curl","fixed_in":["7.49.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"curl","fixed_in":["7.50.1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"curl","fixed_in":["7.50.1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"curl","fixed_in":["7.50.1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"curl","fixed_in":["7.50.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.50.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.50.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.50.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"curl","fixed_in":["7.35.0-1ubuntu2.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"curl","fixed_in":["7.47.0-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.49.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.49.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.50.1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.38.0-4+deb8u4"}]}],"versions":["7.38.0-4","7.38.0-4+deb8u1","7.38.0-4+deb8u2","7.38.0-4+deb8u3"],"bundled":3},{"source":"osv","ecosystem":"Mageia:5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.40.0-3.4.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-1.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-1.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-1.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-1.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.34-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-7.el6"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-1.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-1.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-1.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-1.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.34-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-7.el7"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-28.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-28.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-28.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-28.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.8"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.1"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.8"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.1"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2"],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"haxx","product":"libcurl"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:3558","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://source.android.com/security/bulletin/2016-12-01.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.563059","tags":["vendor-advisory","x_refsource_SLACKWARE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/92306","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3638","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://curl.haxx.se/docs/adv_20160803C.html","tags":["x_refsource_MISC","x_transferred","Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.tenable.com/security/tns-2016-18","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1036536","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201701-47","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3048-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5421","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR"},{"url":"https://github.com/advisories/GHSA-89f8-gvcm-9g9g"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-5421","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2016-5421","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-5421","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0285.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19123","tags":["report"]},{"url":"https://curl.haxx.se/docs/adv_20160803A.html","tags":["web","article"]},{"url":"https://curl.haxx.se/docs/adv_20160803B.html","tags":["web","article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_software_collections/3/html/3.2_release_notes/chap-rhscl#sect-RHSCL-Changes-httpd","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1362183","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1362190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1362199","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1373229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1375906","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388370","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388371","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388377","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388378","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388390","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388392","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1406712","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1439190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1495541","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1503705","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1515757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1515760","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1518737","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1537125","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1540167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1552628","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1552631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1553398","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1558450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560395","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560399","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560599","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560643","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1575536","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1605048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1622707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1628389","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1633260","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1633399","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1634830","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1640722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1648928","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3558.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5419","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5419","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5419","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5420","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5420","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5420","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5421","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5421","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7141","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7141","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20160907.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7167","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7167","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20160914.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8615","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8615","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102A.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8616","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8616","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8616","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102B.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8617","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8617","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8617","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102C.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8618","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8618","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8618","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102D.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8619","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8619","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8619","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102E.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8620","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8620","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8620","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102F.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8621","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8621","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8621","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102G.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8622","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8622","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8622","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102H.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8623","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8623","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102I.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8624","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8624","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8624","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102J.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8625","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8625","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8625","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161102K.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-9586","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9586","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20161221A.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-7407","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7407","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7407","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20170403.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-8816","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8816","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8816","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_2017-12e7.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-8817","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8817","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_2017-ae72.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15710","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15710","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15710","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15715","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15715","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-1000100","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000100","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20170809B.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-1000101","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000101","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000101","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20170809A.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-1000254","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000254","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000254","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20171004.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-1000257","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000257","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000257","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_20171023.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1283","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1283","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1301","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1301","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1301","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1303","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1303","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1303","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1312","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1312","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1312","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1333","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1333","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1333","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-1333","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-11763","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11763","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11763","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14618","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14618","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14618","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/CVE-2018-14618.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000007","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000007","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000007","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_2018-b3bf.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000120","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000120","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000120","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_2018-9cd6.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000121","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000121","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_2018-97a2.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000122","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000122","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000122","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_2018-b047.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000301","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000301","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000301","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/adv_2018-b138.html","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162330-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/991389","tags":["report"]},{"url":"https://bugzilla.suse.com/991390","tags":["report"]},{"url":"https://bugzilla.suse.com/991391","tags":["report"]},{"url":"https://bugzilla.suse.com/991746","tags":["report"]},{"url":"https://bugzilla.suse.com/997420","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7141","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172699-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1056193","tags":["report"]},{"url":"https://bugzilla.suse.com/975726","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9233","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3731","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-5421","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3048-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-5419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5420","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-5421","description":"Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.","status":"published","published":"2016-08-10T14:00:00Z","modified":"2024-08-06T01:01:00.161Z","updated_at":"2026-11-02T14:33:30.767029Z"}],"euvd":[{"id":"EUVD-2016-6366","description":"Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.","status":"published","published":"2016-08-10T14:00:00Z","modified":"2024-08-06T01:01:00Z","updated_at":"2026-11-03T02:22:42.442421Z"}],"ghsa":[{"id":"GHSA-89f8-gvcm-9g9g","title":"Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which...","description":"Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.","status":"published","published":"2022-05-13T01:26:51Z","modified":"2025-04-12T13:03:30Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:01:28.663035Z"}],"nvd":[{"id":"CVE-2016-5421","description":"Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.","status":"published","published":"2016-08-10T14:59:06.33Z","modified":"2026-06-17T00:49:22.877Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:03:28.854267Z"}],"osv":[{"id":"ALPINE-CVE-2016-5421","description":"Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.","status":"published","published":"2016-08-10T14:59:06.33Z","modified":"2026-09-22T06:17:50.324567392Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"BELL-CVE-2016-5421","title":"CVE-2016-5421 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:32.18101Z","modified":"2026-01-26T09:49:12.862417Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2016-5421","description":"Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.","status":"published","published":"2016-08-10T14:59:06.33Z","modified":"2026-10-24T10:30:57.297519674Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-5421","description":"Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.","status":"published","published":"2016-08-10T14:59:06.33Z","modified":"2026-09-22T07:01:32.808720196Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"RHSA-2018:3558","title":"Red Hat Security Advisory: httpd24 security, bug fix, and enhancement update","status":"published","published":"2024-09-13T16:54:33Z","modified":"2026-09-21T10:02:03Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2016-5421","description":"Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.","status":"published","published":"2016-08-03T00:00:00Z","modified":"2026-04-22T10:51:57.554242Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"CURL-CVE-2016-5421","title":"use of connection struct after free","description":"libcurl is vulnerable to a use after free flaw.\n\nlibcurl works with easy handles using the type 'CURL *' that are objects the\napplication creates using `curl_easy_init()`. They are the handles that are all\neach associated with a single transfer at a time. libcurl also has an internal\nstruct that represents and holds most state that is related to a single\nconnection. An easy handle can hold references to one or many such connection\nstructs depending on the requested operations.\n\nWhen using libcurl's multi interface, an application performs transfers by\nadding one or more easy handles to the multi handle and then it can drive all\nthose transfers in parallel.\n\nDue to a flaw, libcurl could leave a pointer to a freed connection struct\ndangling in an easy handle that was previously added to a multi handle when\n`curl_multi_cleanup()` is called with an easy handle still added to it. This\ndoes not seem to cause any notable harm if the handle is then closed properly.\n\nHowever, if the easy handle would instead get used again with the easy\ninterface and `curl_easy_perform()` to do another transfer, it would blindly\nuse the connection struct pointer now pointing to freed memory.\n\nAn application could be made to allocate its own fake version of the connect\nstruct, fill in some data and then have the `curl_easy_perform()` call do\nsomething that clearly was not intended by the original code.\n\nFor example, this could be an application using a component or library that\nuses libcurl to do something against fixed URLs or fixed hostnames or with a\nset of fixed options, but using this flaw the application can then make the\ncomponent to do something completely different and unintended.\n\nPseudo code for a bad application\n\n    easy = curl_easy_init();\n    curl_easy_setopt(easy, CURLOPT_URL, \"http://example.com/\");\n\n    // --- start of code to confuse libcurl ---\n    multi = curl_multi_init();\n    curl_multi_add_handle(multi, easy);\n    curl_multi_perform(multi, \u0026still_running);\n    curl_multi_cleanup(multi);\n\n    // --- attack code\n    allocate_fake_connection_struct()\n    fill_in_fake_connection_struct()\n\n    // ---- end of confusion code\n\n    // now this is called, it does not use example.com at all even if the\n    // option above asks for it...\n\n    curl_easy_perform(easy);\n\nThis flaw can also be exploited using libcurl bindings in other languages.","status":"published","published":"2016-08-03T08:00:00Z","modified":"2026-10-24T23:17:46Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"DSA-3638-1","title":"curl - security update","status":"published","published":"2016-08-03T00:00:00Z","modified":"2026-03-09T01:18:39.566188Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0285","title":"Updated curl packages fix security vulnerability","description":"libcurl before 7.50.1 would attempt to resume a TLS session even if the\nclient certificate had changed. That is unacceptable since a server by\nspecification is allowed to skip the client certificate check on resume,\nand may instead use the old identity which was established by the previous\ncertificate (or no certificate) (CVE-2016-5419).\n\nIn libcurl before 7.50.1, when using a client certificate for a connection\nthat was then put into the connection pool, that connection could then\nwrongly get reused in a subsequent request to that same server. This\nmistakenly using the wrong connection could lead to applications sending\nrequests to the wrong realms of the server using authentication that it\nwasn't supposed to have for those operations (CVE-2016-5420).\n\nlibcurl before 7.50.1 is vulnerable to a use-after-free flaw in\ncurl_easy_perform() (CVE-2016-5421).\n","status":"published","published":"2016-08-31T15:32:33Z","modified":"2026-04-16T06:23:06.666190413Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2016:2330-1","title":"Security update for curl","description":"\nThis update for curl fixes the following issues:\n\nSecurity issues fixed:\n- CVE-2016-5419: TLS session resumption client cert bypass (bsc#991389)\n- CVE-2016-5420: Re-using connections with wrong client cert (bsc#991390)\n- CVE-2016-5421: use of connection struct after free (bsc#991391)\n- CVE-2016-7141: Fixed incorrect reuse of client certificates with NSS (bsc#997420)\n\nAlso the following bug was fixed:\n- fixing a performance issue (bsc#991746)\n","status":"published","published":"2016-09-16T15:13:59Z","modified":"2026-02-04T02:42:07.540369Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2017:2699-1","title":"Security update for SLES 12 Docker image","description":"The SUSE Linux Enterprise Server 12 container image has been updated to include\nsecurity and stability fixes.\n\nThe following issues related to building of the container images have been fixed:\n\n- Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a\n  dependency by the Build Service solver. (bsc#1056193)\n- Do not install recommended packages when building container images. (bsc#975726)\n\nA number of security issues that have been already fixed by updates released for\nSUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE\ncross-reference is available below.\n\npam:\n\n- CVE-2015-3238\n\nlibtasn1:\n\n- CVE-2015-3622\n- CVE-2016-4008\n\nlibidn:\n\n- CVE-2015-2059\n- CVE-2015-8948\n- CVE-2016-6261\n- CVE-2016-6262\n- CVE-2016-6263\n\nzlib:\n\n- CVE-2016-9840\n- CVE-2016-9841\n- CVE-2016-9842\n- CVE-2016-9843\n\ncurl:\n\n- CVE-2016-5419\n- CVE-2016-5420\n- CVE-2016-5421\n- CVE-2016-7141\n- CVE-2016-7167\n- CVE-2016-8615\n- CVE-2016-8616\n- CVE-2016-8617\n- CVE-2016-8618\n- CVE-2016-8619\n- CVE-2016-8620\n- CVE-2016-8621\n- CVE-2016-8622\n- CVE-2016-8623\n- CVE-2016-8624\n- CVE-2016-9586\n- CVE-2017-1000100\n- CVE-2017-1000101\n- CVE-2017-7407\n\nopenssl:\n\n- CVE-2016-2105\n- CVE-2016-2106\n- CVE-2016-2107\n- CVE-2016-2108\n- CVE-2016-2109\n- CVE-2016-2177\n- CVE-2016-2178\n- CVE-2016-2179\n- CVE-2016-2180\n- CVE-2016-2181\n- CVE-2016-2182\n- CVE-2016-2183\n- CVE-2016-6302\n- CVE-2016-6303\n- CVE-2016-6304\n- CVE-2016-6306\n\nlibxml2:\n\n- CVE-2014-0191\n- CVE-2015-8806\n- CVE-2016-1762\n- CVE-2016-1833\n- CVE-2016-1834\n- CVE-2016-1835\n- CVE-2016-1837\n- CVE-2016-1838\n- CVE-2016-1839\n- CVE-2016-1840\n- CVE-2016-2073\n- CVE-2016-3627\n- CVE-2016-3705\n- CVE-2016-4447\n- CVE-2016-4448\n- CVE-2016-4449\n- CVE-2016-4483\n- CVE-2016-4658\n- CVE-2016-9318\n- CVE-2016-9597\n- CVE-2017-9047\n- CVE-2017-9048\n- CVE-2017-9049\n- CVE-2017-9050\n\nutil-linux:\n\n- CVE-2015-5218\n- CVE-2016-5011\n- CVE-2017-2616\n\ncracklib:\n\n- CVE-2016-6318\n\nsystemd:\n\n- CVE-2014-9770\n- CVE-2015-8842\n- CVE-2016-7796\n\npcre:\n\n- CVE-2014-8964\n- CVE-2015-2325\n- CVE-2015-2327\n- CVE-2015-2328\n- CVE-2015-3210\n- CVE-2015-3217\n- CVE-2015-5073\n- CVE-2015-8380\n- CVE-2015-8381\n- CVE-2015-8382\n- CVE-2015-8383\n- CVE-2015-8384\n- CVE-2015-8385\n- CVE-2015-8386\n- CVE-2015-8387\n- CVE-2015-8388\n- CVE-2015-8389\n- CVE-2015-8390\n- CVE-2015-8391\n- CVE-2015-8392\n- CVE-2015-8393\n- CVE-2015-8394\n- CVE-2015-8395\n- CVE-2016-1283\n- CVE-2016-3191\n\nappamor:\n\n- CVE-2017-6507\n\nbash:\n\n- CVE-2014-6277\n- CVE-2014-6278\n- CVE-2016-0634\n- CVE-2016-7543\n\ncpio:\n\n- CVE-2016-2037\n\nglibc:\n\n- CVE-2016-1234\n- CVE-2016-3075\n- CVE-2016-3706\n- CVE-2016-4429\n- CVE-2017-1000366\n\nperl:\n\n- CVE-2015-8853\n- CVE-2016-1238\n- CVE-2016-2381\n- CVE-2016-6185\n\nlibssh2_org:\n\n- CVE-2016-0787\n\nexpat:\n\n- CVE-2012-6702\n- CVE-2015-1283\n- CVE-2016-0718\n- CVE-2016-5300\n- CVE-2016-9063\n- CVE-2017-9233\n\nncurses:\n\n- CVE-2017-10684\n- CVE-2017-10685\n- CVE-2017-11112\n- CVE-2017-11113\n\nlibksba:\n\n- CVE-2016-4574\n- CVE-2016-4579\n\nlibgcrypt:\n\n- CVE-2015-7511\n- CVE-2016-6313\n- CVE-2017-7526\n\ndbus-1:\n\n- CVE-2014-7824\n- CVE-2015-0245\n\nFinally, the following packages received non-security fixes:\n\n- augeas\n- bzip2\n- ca-certificates-mozilla\n- coreutils\n- cryptsetup\n- cyrus-sasl\n- dirmngr\n- e2fsprogs\n- findutils\n- gpg2\n- insserv-compat\n- kmod\n- libcap\n- libsolv\n- libzypp\n- openldap2\n- p11-kit\n- permissions\n- procps\n- rpm\n- sed\n- shadow\n- zypper\n","status":"published","published":"2017-10-10T19:37:24Z","modified":"2026-02-04T03:24:03.922844Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2700-1","title":"Security update for SLES 12-SP1 Docker image","description":"The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include\nsecurity and stability fixes.\n\nThe following issues related to building of the container images have been fixed:\n\n- Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a\n  dependency by the Build Service solver. (bsc#1056193)\n- Do not install recommended packages when building container images. (bsc#975726)\n\nA number of security issues that have been already fixed by updates released for\nSUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE\ncross-reference is available below.\n\npam:\n\n- CVE-2015-3238\n\nlibtasn1:\n\n- CVE-2015-3622\n- CVE-2016-4008\n\nexpat:\n\nexpat:\n\n- CVE-2012-6702\n- CVE-2015-1283\n- CVE-2016-0718\n- CVE-2016-5300\n- CVE-2016-9063\n- CVE-2017-9233\n\nlibidn:\n\n- CVE-2015-2059\n- CVE-2015-8948\n- CVE-2016-6261\n- CVE-2016-6262\n- CVE-2016-6263\n\n\nzlib:\n\n- CVE-2016-9840\n- CVE-2016-9841\n- CVE-2016-9842\n- CVE-2016-9843\n\ncurl:\n\n- CVE-2016-5419\n- CVE-2016-5420\n- CVE-2016-5421\n- CVE-2016-7141\n- CVE-2016-7167\n- CVE-2016-8615\n- CVE-2016-8616\n- CVE-2016-8617\n- CVE-2016-8618\n- CVE-2016-8619\n- CVE-2016-8620\n- CVE-2016-8621\n- CVE-2016-8622\n- CVE-2016-8623\n- CVE-2016-8624\n- CVE-2016-9586\n- CVE-2017-1000100\n- CVE-2017-1000101\n- CVE-2017-7407\n\nopenssl:\n\n- CVE-2016-2105\n- CVE-2016-2106\n- CVE-2016-2107\n- CVE-2016-2108\n- CVE-2016-2109\n- CVE-2016-2177\n- CVE-2016-2178\n- CVE-2016-2179\n- CVE-2016-2180\n- CVE-2016-2181\n- CVE-2016-2182\n- CVE-2016-2183\n- CVE-2016-6302\n- CVE-2016-6303\n- CVE-2016-6304\n- CVE-2016-6306\n- CVE-2016-7056\n- CVE-2016-8610\n- CVE-2017-3731\n\ncracklib:\n\n- CVE-2016-6318\n\npcre:\n\n- CVE-2014-8964\n- CVE-2015-2325\n- CVE-2015-2327\n- CVE-2015-2328\n- CVE-2015-3210\n- CVE-2015-3217\n- CVE-2015-5073\n- CVE-2015-8380\n- CVE-2015-8381\n- CVE-2015-8382\n- CVE-2015-8383\n- CVE-2015-8384\n- CVE-2015-8385\n- CVE-2015-8386\n- CVE-2015-8387\n- CVE-2015-8388\n- CVE-2015-8389\n- CVE-2015-8390\n- CVE-2015-8391\n- CVE-2015-8392\n- CVE-2015-8393\n- CVE-2015-8394\n- CVE-2015-8395\n- CVE-2016-1283\n- CVE-2016-3191\n\nappamor:\n\n- CVE-2017-6507\n\nbash:\n\n- CVE-2014-6277\n- CVE-2014-6278\n- CVE-2016-0634\n- CVE-2016-7543\n\ncpio:\n\n- CVE-2016-2037\n\nglibc:\n\n- CVE-2016-1234\n- CVE-2016-3075\n- CVE-2016-3706\n- CVE-2016-4429\n- CVE-2017-1000366\n\nperl:\n\n- CVE-2015-8853\n- CVE-2016-1238\n- CVE-2016-2381\n- CVE-2016-6185\n\nlibssh2_org:\n\n- CVE-2016-0787\n\nutil-linux:\n\n- CVE-2016-5011\n- CVE-2017-2616\n\nncurses:\n\n- CVE-2017-10684\n- CVE-2017-10685\n- CVE-2017-11112\n- CVE-2017-11113\n\nlibksba:\n\n- CVE-2016-4574\n- CVE-2016-4579\n\nlibxml2:\n\n- CVE-2014-0191\n- CVE-2015-8806\n- CVE-2016-1762\n- CVE-2016-1833\n- CVE-2016-1834\n- CVE-2016-1835\n- CVE-2016-1837\n- CVE-2016-1838\n- CVE-2016-1839\n- CVE-2016-1840\n- CVE-2016-2073\n- CVE-2016-3627\n- CVE-2016-3705\n- CVE-2016-4447\n- CVE-2016-4448\n- CVE-2016-4449\n- CVE-2016-4483\n- CVE-2016-4658\n- CVE-2016-9318\n- CVE-2016-9597\n- CVE-2017-9047\n- CVE-2017-9048\n- CVE-2017-9049\n- CVE-2017-9050\n\nlibgcrypt:\n\n- CVE-2015-7511\n- CVE-2016-6313\n- CVE-2017-7526\n\nupdate-alternatives:\n\n- CVE-2015-0860\n\nsystemd:\n\n- CVE-2014-9770\n- CVE-2015-8842\n- CVE-2016-7796\n\ndbus-1:\n\n- CVE-2014-7824\n- CVE-2015-0245\n\nFinally, the following packages received non-security fixes:\n\n- augeas\n- bzip2\n- ca-certificates-mozilla\n- coreutils\n- cryptsetup\n- cyrus-sasl\n- dirmngr\n- e2fsprogs\n- findutils\n- gpg2\n- insserv-compat\n- kmod\n- libcap\n- libsolv\n- libzypp\n- lua51\n- lvm2\n- netcfg\n- p11-kit\n- permissions\n- procps\n- rpm\n- sed\n- sg3_utils\n- shadow\n- zypper\n","status":"published","published":"2017-10-10T19:37:36Z","modified":"2026-02-04T03:03:17.897778Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-3048-1","title":"curl vulnerabilities","description":"Bru Rom discovered that curl incorrectly handled client certificates when\nresuming a TLS session. (CVE-2016-5419)\n\nIt was discovered that curl incorrectly handled client certificates when\nreusing TLS connections. (CVE-2016-5420)\n\nMarcelo Echeverria and Fernando Muñoz discovered that curl incorrectly\nreused a connection struct, contrary to expectations. This issue only\napplied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5421)\n","status":"published","published":"2016-08-08T17:05:10Z","modified":"2026-04-22T09:26:42.740123Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}