Debian Curl vulnerabilities

CVE-2016-8625 [MEDIUM] CVE-2016-8625: curl - curl before version 7.51.0 uses outdated IDNA 2003 standard to handle Internatio... curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host. Scope: local bookworm: resolved (fixed in 7.51.0-1) bullseye: resolved (fixed in 7.51.0-1) forky: resolved (fixed in 7.51.0-1) sid: resolved (fixed in 7.51.0-1) trixie:

CVE-2022-27781 [HIGH] CVE-2022-27781: curl - libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest d... libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation. Scope: local bookworm: resolved (fixed in 7.83.1-1) bullseye: resolved (f

CVE-2024-9681 [MEDIUM] CVE-2024-9681: curl - When curl is asked to use HSTS, the expiry time for a subdomain might overwrite ... When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is

CVE-2019-3823 [MEDIUM] CVE-2019-3823: curl - libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bo... libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be r

CVE-2020-8177 [HIGH] CVE-2020-8177: curl - curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for fi... curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used. Scope: local bookworm: resolved (fixed in 7.72.0-1) bullseye: resolved (fixed in 7.72.0-1) forky: resolved (fixed in 7.72.0-1) sid: resolved (fixed in 7.72.0-1) trixie: resolved (fixed in 7.72.0-1)

CVE-2017-7468 [HIGH] CVE-2017-7468: curl - In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to res... In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl sup

CVE-2016-8623 [LOW] CVE-2016-8623: curl - A flaw was found in curl before version 7.51.0. The way curl handles cookies per... A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure. Scope: local bookworm: resolved (fixed in 7.51.0-1) bullseye: resolved (fixed in 7.51.0-1) forky: resolved (fixed in 7.51.0-1) sid: resolved (fixed in 7.51.0-1) trixie: resolved (fixed in 7.51.0-1)

CVE-2022-32208 [MEDIUM] CVE-2022-32208: curl - When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verifi... When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. Scope: local bookworm: resolved (fixed in 7.84.0-1) bullseye: resolved (fixed in 7.74.0-1.3+deb11u2) forky: resolved (fixed in 7.84.0-1) sid

CVE-2023-46218 [MEDIUM] CVE-2023-46218: curl - This flaw allows a malicious HTTP server to set "super cookies" in curl that are... This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain ag

CVE-2015-3143 [MEDIUM] CVE-2015-3143: curl - cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections... cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015. Scope: local bookworm: resolved (fixed in 7.42.0-1) bullseye: resolved (fixed in 7.42.0-1) forky: resolved (fixed in 7.42.0-1) sid: resolved (fixed in 7.42.0-1) trixie

CVE-2022-27776 [MEDIUM] CVE-2022-27776: curl - A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 mig... A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number. Scope: local bookworm: resolved (fixed in 7.83.0-1) bullseye: resolved (fixed in 7.74.0-1.3+deb11u2) forky: resolved (fixed in 7.83.0-1) sid: resolved (fixed in 7.83.0-1) trixie: resol

CVE-2009-2417 [MEDIUM] CVE-2009-2417: curl - lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does ... lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-200

CVE-2021-22947 [MEDIUM] CVE-2021-22947: curl - When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve... When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS han

CVE-2021-22922 [MEDIUM] CVE-2021-22922: curl - When curl is instructed to download content using the metalink feature, theconte... When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a seria

CVE-2017-1000100 [MEDIUM] CVE-2017-1000100: curl - When doing a TFTP transfer and curl/libcurl is given a URL that contains a very ... When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than

CVE-2025-0665 [HIGH] CVE-2025-0665: curl - libcurl would wrongly close the same eventfd file descriptor twice when taking d... libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 8.12.0+git20250209.89ed161+ds-1) sid: resolved (fixed in 8.12.0+git20250209.89ed161+ds-1) trixie: resolved (fixed in 8.12.0+git20250209.89ed161

CVE-2024-2466 [MEDIUM] CVE-2024-2466: curl - libcurl did not check the server certificate of TLS connections done to a host s... libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, S

CVE-2026-3784 [MEDIUM] CVE-2026-3784: curl - curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a se... curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 8.19.0-1) sid: resolved (fixed in 8.19.0-1) trixie: open

CVE-2023-27535 [MEDIUM] CVE-2023-27535: curl - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP conne... An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_US

CVE-2017-1000101 [MEDIUM] CVE-2017-1000101: curl - curl supports "globbing" of URLs, in which a user can pass a numerical range to ... curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in