Debian Curl vulnerabilities

CVE-2014-3707 [MEDIUM] CVE-2014-3707: curl - The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running ... The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information. Scope: local bookworm: resolved (fixed in 7.38.0-3) bullseye: resolved (fixed in 7.38.0

CVE-2014-0015 [MEDIUM] CVE-2014-0015: curl - cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method... cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request. Scope: local bookworm: resolved (fixed in 7.35.0-1) bullseye: resolved (fixed in 7.35.0-1) forky: resolved (fixed in 7.35.0-1) sid: resolved (fixed in 7.35.0-1)

CVE-2013-4545 [MEDIUM] CVE-2013-4545: curl - cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the ce... cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Scope: local bookworm: resolved (fixed in 7.3

CVE-2025-11563 [MEDIUM] CVE-2025-11563: curl - URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving... URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 8.17.0-2) sid: resolved (fixed in 8.17.0-2) trixie: resolved (fixed

CVE-2024-6874 [MEDIUM] CVE-2024-6874: curl - libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_g... libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the *macidn* IDN backend. The conversion function then fills up the provided buffer exactly - but does not nul

CVE-2025-10966 [MEDIUM] CVE-2025-10966: curl - curl's code for managing SSH connections when SFTP was done using the wolfSSH po... curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 8.17.0~rc2-1) sid: resolved (fixed in 8.17.0~rc2-1) trixie: open

CVE-2024-0853 [MEDIUM] CVE-2024-0853: curl - curl inadvertently kept the SSL session ID for connections in its cache even whe... curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 8.6.0-1) sid: re

CVE-2025-5025 [MEDIUM] CVE-2025-5025: curl - libcurl supports *pinning* of the server certificate public key for HTTPS transf... libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine,

CVE-2022-30115 [MEDIUM] CVE-2022-30115: curl - Using its HSTS support, curl can be instructed to use HTTPS directly insteadof u... Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *no

CVE-2021-22924 [LOW] CVE-2021-22924: curl - libcurl keeps previously used connections in a connection pool for subsequenttra... libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sens

CVE-2023-38546 [LOW] CVE-2023-38546: curl - This flaw allows an attacker to insert cookies at will into a running program us... This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://

CVE-2020-8284 [LOW] CVE-2020-8284: curl - A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlie... A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. Scope: local bookworm: resolved (fixed in 7.74.0-1) bullsey

CVE-2019-5435 [LOW] CVE-2019-5435: curl - An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.... An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. Scope: local bookworm: resolved (fixed in 7.64.0-4) bullseye: resolved (fixed in 7.64.0-4) forky: resolved (fixed in 7.64.0-4) sid: resolved (fixed in 7.64.0-4) trixie: resolved (fixed in 7.64.0-4)

CVE-2021-22898 [LOW] CVE-2021-22898: curl - curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` com... curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in

CVE-2013-6422 [MEDIUM] CVE-2013-6422: curl - The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital sign... The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks. Scope: local bookworm: resolved (fixed in 7.34.0-1) bullseye:

CVE-2021-22890 [LOW] CVE-2021-22890: curl - curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicio... curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When

CVE-2023-28322 [LOW] CVE-2023-28322: curl - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S... An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the applicati

CVE-2024-2004 [LOW] CVE-2024-2004: curl - When a protocol selection parameter option disables all protocols without adding... When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only

CVE-2022-35252 [LOW] CVE-2022-35252: curl - When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts... When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings. Scope: local bookworm: resolved (fixed in 7.85.0-1) bullseye: resolved (fixed in 7.74.0-1.3+deb11u3) for

CVE-2024-11053 [LOW] CVE-2024-11053: curl - When asked to both use a `.netrc` file for credentials and to follow HTTP redire... When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and passwor