Debian Curl vulnerabilities

CVE-2018-1000122 [CRITICAL] CVE-2018-1000122: curl - A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTS... A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage Scope: local bookworm: resolved (fixed in 7.60.0-1) bullseye: resolved (fixed in 7.60.0-1) forky: resolved (fixed in 7.60.0-1) sid: resolved (fixed in 7.60.0-1) trixie: resolved (fixed in

CVE-2016-0755 [MEDIUM] CVE-2016-0755: curl - The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not pro... The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015. Scope: local bookworm: resolved (fixed in 7.47.0-1) bullseye: resolved (fixed in 7.47.0-1) forky: resolved (fixed in 7.47.0-1

CVE-2024-7264 [MEDIUM] CVE-2024-7264: curl - libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an A... libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads t

CVE-2017-8817 [CRITICAL] CVE-2017-8817: curl - The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attack... The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character. Scope: local bookworm: resolved (fixed in 7.57.0-1) bullseye: resolved (fixed in 7.57.0-1) forky: resolved (fixed in 7.57.0-1

CVE-2017-1000254 [HIGH] CVE-2017-1000254: curl - libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl... libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequ

CVE-2016-8622 [LOW] CVE-2016-8622: curl - The URL percent-encoding decode function in libcurl before 7.51.0 is called `cur... The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could the

CVE-2016-8619 [MEDIUM] CVE-2016-8619: curl - The function `read_data()` in security.c in curl before version 7.51.0 is vulner... The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free. Scope: local bookworm: resolved (fixed in 7.51.0-1) bullseye: resolved (fixed in 7.51.0-1) forky: resolved (fixed in 7.51.0-1) sid: resolved (fixed in 7.51.0-1) trixie: resolved (fixed in 7.51.0-1)

CVE-2023-23914 [CRITICAL] CVE-2023-23914: curl - A cleartext transmission of sensitive information vulnerability exists in curl <... A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly b

CVE-2018-16840 [CRITICAL] CVE-2018-16840: curl - A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1... A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed str

CVE-2016-9586 [MEDIUM] CVE-2016-9586: curl - curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large... curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks. Scope: local bookworm: resolved (fixed in 7.52.1-1) bullseye: resolved (

CVE-2025-0725 [HIGH] CVE-2025-0725: curl - When libcurl is asked to perform automatic gzip decompression of content-encoded... When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 8.12.0+git20250209.89ed161+ds-1) sid: resolved

CVE-2020-8231 [HIGH] CVE-2020-8231: curl - Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wron... Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data. Scope: local bookworm: resolved (fixed in 7.72.0-1) bullseye: resolved (fixed in 7.72.0-1) forky: resolved (fixed in 7.72.0-1) sid: resolved (fixed in 7.72.0-1) trixie: resolved (fixed in 7.72.0-1)

CVE-2023-28319 [HIGH] CVE-2023-28319: curl - A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers ... A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that m

CVE-2015-3144 [CRITICAL] CVE-2015-3144: curl - The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not pro... The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80." Scope: local bookworm: resolved (fixed in 7.42.0-1

CVE-2003-1605 [HIGH] CVE-2003-1605: curl - curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server. curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server. Scope: local bookworm: resolved (fixed in 7.10.7-1) bullseye: resolved (fixed in 7.10.7-1) forky: resolved (fixed in 7.10.7-1) sid: resolved (fixed in 7.10.7-1) trixie: resolved (fixed in 7.10.7-1)

CVE-2026-3805 [HIGH] CVE-2026-3805: curl - When doing a second SMB request to the same host again, curl would wrongly use a... When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 8.19.0-1) sid: resolved (fixed in 8.19.0-1) trixie: open

CVE-2016-8624 [MEDIUM] CVE-2016-8624: curl - curl before version 7.51.0 doesn't parse the authority component of the URL corr... curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them. Scope: loc

CVE-2016-8615 [MEDIUM] CVE-2016-8615: curl - A flaw was found in curl before version 7.51. If cookie state is written into a ... A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar. Scope: local bookworm: resolved (fixed in 7.51.0-1) bullseye: resolved (fixed in 7.51.0-1) forky: resolved (fixed in 7.51.0-1)

CVE-2020-8286 [HIGH] CVE-2020-8286: curl - curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate re... curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. Scope: local bookworm: resolved (fixed in 7.74.0-1) bullseye: resolved (fixed in 7.74.0-1) forky: resolved (fixed in 7.74.0-1) sid: resolved (fixed in 7.74.0-1) trixie: resolved (fixed in 7.74.0-1)

CVE-2024-6197 [HIGH] CVE-2024-6197: curl - libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 ... libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list