CVE-2015-3145 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Curl
Severity
7.5HIGHNVD
EPSS
63.7%
top 1.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 24
Latest updateMay 14
Description
The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.
CVSS vector
AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4
Affected Packages7 packages
Also affects: Debian Linux 7.0, Fedora 21, 22, Ubuntu Linux 12.04, 14.04, 14.10, 15.04