Skip to contentHaxx Curl vulnerabilities
- haxx libcurl, debian linux +1 moreAn IMAP FETCH response line indicates the size of the returned data, in number of bytes. When...CVE-2017-1000257Fix available9.1 Critical
- haxx libcurllibcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an...CVE-2017-1000254Fix available7.5 High
- haxx curlcurl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool...CVE-2017-1000101Fix available6.5 Medium
- haxx libcurlWhen doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name ...CVE-2017-1000100Fix available6.5 Medium
- haxx libcurlWhen asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data...CVE-2017-1000099Fix available6.5 Medium
- haxx curlIn curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic...CVE-2017-95025.3 Medium
- [unknown] curl, haxx libcurl +1 moreIn curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session...CVE-2017-7468Fix available4.8 Medium
- haxx curlThe ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate...CVE-2017-7407Fix available2.4 Low
- curlcurl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks...CVE-2017-2629Fix available4.3 Medium
- curlcurl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal...CVE-2016-9594Fix available6.5 Medium
- haxx curlThe verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when...CVE-2016-9953Fix available9.8 Critical
- haxx curlThe verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when...CVE-2016-9952Fix available8.1 High
- curlcurl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point...CVE-2016-9586Fix available5.9 Medium
- curlcurl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names...CVE-2016-8625Fix available5.3 Medium
- curlcurl before version 7.51.0 doesn't parse the authority component of the URL correctly when the...CVE-2016-8624Fix available5.3 Medium
- curlA flaw was found in curl before version 7.51.0. The way curl handles cookies permits other...CVE-2016-8623Fix available3.3 Low
- curl, haxx libcurl +1 moreThe URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`....CVE-2016-8622Fix available3.7 Low
- curlThe `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read...CVE-2016-8621Fix available5.3 Medium
- curlThe 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow...CVE-2016-8620Fix available6.5 Medium
- curlThe function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory...CVE-2016-8619Fix available5.3 Medium
- curlThe libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing...CVE-2016-8618Fix available5.3 Medium
- curlThe base64 encode function in curl before version 7.51.0 is prone to a buffer being under...CVE-2016-8617Fix available3.3 Low
- curlA flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case...CVE-2016-8616Fix available3.7 Low
- curlA flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file...CVE-2016-8615Fix available5.3 Medium
- haxx libcurl, fedoraproject fedora +1 moreMultiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and ...CVE-2016-7167Fix availableEPSS 11.7%9.8 Critical
- haxx libcurl, opensuse leap +1 morecurl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at...CVE-2016-7141Fix available7.5 High
- haxx libcurl, canonical ubuntu linux, debian linux +3 more +5 moreUse-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which...CVE-2016-5421Fix available8.1 High
- haxx libcurl, debian linux, opensuse leap +2 morecurl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS...CVE-2016-5420Fix availableEPSS 15.4%7.5 High
- haxx libcurl, debian linux, opensuse leap +2 morecurl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate...CVE-2016-5419Fix availableEPSS 15.1%7.5 High
- haxx curlMultiple untrusted search path vulnerabilities in cURL and libcurl before 7.49.1, when built with...CVE-2016-48027.8 High
- haxx curlThe (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function...CVE-2016-3739Fix available5.3 Medium
- haxx curlcURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working...CVE-2016-07545.3 Medium
- haxx curl, canonical ubuntu linux, debian linux +2 moreThe ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM...CVE-2016-0755Fix available7.3 High
- haxx curl, libcurl, hp system management homepage +2 more +4 moreThe smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB...CVE-2015-3237Fix available6.4 Medium
- haxx curl, libcurl +1 morecURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a...CVE-2015-3236Fix available5.0 Medium
- haxx curl, libcurl, apple mac os x +6 more +8 moreThe sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly...CVE-2015-3145Fix availableEPSS 30.5%7.5 High
- haxx curl, libcurl, canonical ubuntu linux +2 more +4 moreThe fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate...CVE-2015-3144Fix availableEPSS 10.5%9.0 High
- haxx libcurl, apple mac os x +1 moreThe darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39...CVE-2014-81515.8 Medium
- haxx libcurl, canonical ubuntu linux, debian linux +2 moreCRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy,...CVE-2014-8150Fix available4.3 Medium
- haxx libcurl, apple mac os x, canonical ubuntu linux +3 more +5 moreThe curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the...CVE-2014-3707Fix available4.3 Medium
- haxx curl, libcurl, apple mac os x +2 morecURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set...CVE-2014-3620Fix available5.0 Medium
- haxx curl, libcurl, apple mac os x +2 morecURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names,...CVE-2014-3613Fix available5.0 Medium
- haxx curl, libcurl, apple mac os x +3 more +5 moreThe default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both...CVE-2015-3153Fix available5.0 Medium
- haxx curl, libcurl, apple mac os x +5 more +7 morecURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections...CVE-2015-3148Fix availableEPSS 14.1%5.0 Medium
- haxx curl, libcurl, apple mac os x +3 more +5 morecURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows...CVE-2015-3143Fix availableEPSS 11.1%5.0 Medium
- haxx curl, libcurl +1 morecurl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS...CVE-2014-25224.0 Medium
- haxx curl, libcurl +1 morecURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for...CVE-2014-0139Fix available5.8 Medium
- haxx curl, libcurl, debian linux +2 moreThe default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3)...CVE-2014-0138Fix available6.4 Medium
- haxx curl, libcurl +1 morecURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re...CVE-2014-0015Fix available4.0 Medium
- haxx libcurl, canonical ubuntu linux, debian linux +2 moreThe GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature...CVE-2013-6422Fix available4.0 Medium
- Show moreLoading…