Debian Curl vulnerabilities

CVE-2017-1000257 [CRITICAL] CVE-2017-1000257: curl - An IMAP FETCH response line indicates the size of the returned data, in number o... An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the l

CVE-2018-1000301 [CRITICAL] CVE-2018-1000301: curl - curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer... curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl = 7.60.0. Scope: local bookworm: resolved (fixed

CVE-2017-1000254 [HIGH] CVE-2017-1000254: curl - libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl... libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequ

CVE-2016-8620 [MEDIUM] CVE-2016-8620: curl - The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to in... The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input. Scope: local bookworm: resolved (fixed in 7.51.0-1) bullseye: resolved (fixed in 7.51.0-1) forky: resolved (fixed in 7.51.0-1) sid: resolved (fixed in 7.51.0-1) trixie: resolved (fixed in 7.51.0-1)

CVE-2016-8619 [MEDIUM] CVE-2016-8619: curl - The function `read_data()` in security.c in curl before version 7.51.0 is vulner... The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free. Scope: local bookworm: resolved (fixed in 7.51.0-1) bullseye: resolved (fixed in 7.51.0-1) forky: resolved (fixed in 7.51.0-1) sid: resolved (fixed in 7.51.0-1) trixie: resolved (fixed in 7.51.0-1)

CVE-2023-23914 [CRITICAL] CVE-2023-23914: curl - A cleartext transmission of sensitive information vulnerability exists in curl <... A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly b

CVE-2016-8622 [LOW] CVE-2016-8622: curl - The URL percent-encoding decode function in libcurl before 7.51.0 is called `cur... The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could the

CVE-2016-9586 [MEDIUM] CVE-2016-9586: curl - curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large... curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks. Scope: local bookworm: resolved (fixed in 7.52.1-1) bullseye: resolved (

CVE-2018-16840 [CRITICAL] CVE-2018-16840: curl - A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1... A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed str

CVE-2024-7264 [MEDIUM] CVE-2024-7264: curl - libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an A... libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads t

CVE-2023-28319 [HIGH] CVE-2023-28319: curl - A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers ... A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that m

CVE-2015-3144 [CRITICAL] CVE-2015-3144: curl - The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not pro... The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80." Scope: local bookworm: resolved (fixed in 7.42.0-1

CVE-2003-1605 [HIGH] CVE-2003-1605: curl - curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server. curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server. Scope: local bookworm: resolved (fixed in 7.10.7-1) bullseye: resolved (fixed in 7.10.7-1) forky: resolved (fixed in 7.10.7-1) sid: resolved (fixed in 7.10.7-1) trixie: resolved (fixed in 7.10.7-1)

CVE-2026-3805 [HIGH] CVE-2026-3805: curl - When doing a second SMB request to the same host again, curl would wrongly use a... When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 8.19.0-1) sid: resolved (fixed in 8.19.0-1) trixie: open

CVE-2018-16890 [HIGH] CVE-2018-16890: curl - libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out... libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to acc

CVE-2016-8615 [MEDIUM] CVE-2016-8615: curl - A flaw was found in curl before version 7.51. If cookie state is written into a ... A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar. Scope: local bookworm: resolved (fixed in 7.51.0-1) bullseye: resolved (fixed in 7.51.0-1) forky: resolved (fixed in 7.51.0-1)

CVE-2020-8286 [HIGH] CVE-2020-8286: curl - curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate re... curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. Scope: local bookworm: resolved (fixed in 7.74.0-1) bullseye: resolved (fixed in 7.74.0-1) forky: resolved (fixed in 7.74.0-1) sid: resolved (fixed in 7.74.0-1) trixie: resolved (fixed in 7.74.0-1)

CVE-2024-6197 [HIGH] CVE-2024-6197: curl - libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 ... libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list

CVE-2020-8231 [HIGH] CVE-2020-8231: curl - Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wron... Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data. Scope: local bookworm: resolved (fixed in 7.72.0-1) bullseye: resolved (fixed in 7.72.0-1) forky: resolved (fixed in 7.72.0-1) sid: resolved (fixed in 7.72.0-1) trixie: resolved (fixed in 7.72.0-1)

CVE-2025-9086 [HIGH] CVE-2025-9086: curl - 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is ... 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path=\"/\",`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the