Product:

Libcurl

(Haxx)
Repositories • https://github.com/bagder/curl
• https://github.com/curl/curl
#Vulnerabilities 61
Date Id Summary Products Score Patch Annotated
2014-02-01 CVE-2014-0015 cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request. Curl, Libcurl N/A
2013-12-23 CVE-2013-6422 The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks. Ubuntu_linux, Debian_linux, Libcurl N/A
2013-11-23 CVE-2013-4545 cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Curl, Libcurl N/A
2013-07-31 CVE-2013-2174 Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character. Ubuntu_linux, Curl, Libcurl, Opensuse, Enterprise_linux N/A
2013-04-29 CVE-2013-1944 The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL. Ubuntu_linux, Curl, Libcurl N/A
2013-03-08 CVE-2013-0249 Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message. Ubuntu_linux, Curl, Libcurl N/A