CVE-2015-3144

2015-04-2414:59:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2015-3144

curl

libcurl

fix_hostname

denial of service

out-of-bounds

nvd

9.2 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.065 Low

EPSS

Percentile

93.7%

JSON

The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by “http://:80” and “:80.”

CPENameOperatorVersion
oracle:mysql_enterprise_monitororacle mysql enterprise monitorle2.3.20
oracle:mysql_enterprise_monitororacle mysql enterprise monitorle3.0.22
haxx:curlhaxx curleq7.40.0
haxx:curlhaxx curleq7.38.0
haxx:curlhaxx curleq7.41.0
haxx:curlhaxx curleq7.37.1
haxx:curlhaxx curleq7.37.0
haxx:curlhaxx curleq7.39.0
haxx:libcurlhaxx libcurleq7.37.0
haxx:libcurlhaxx libcurleq7.40.0

CPE	Name	Operator	Version
oracle:mysql_enterprise_monitor	oracle mysql enterprise monitor	le	2.3.20
oracle:mysql_enterprise_monitor	oracle mysql enterprise monitor	le	3.0.22
haxx:curl	haxx curl	eq	7.40.0
haxx:curl	haxx curl	eq	7.38.0
haxx:curl	haxx curl	eq	7.41.0
haxx:curl	haxx curl	eq	7.37.1
haxx:curl	haxx curl	eq	7.37.0
haxx:curl	haxx curl	eq	7.39.0
haxx:libcurl	haxx libcurl	eq	7.37.0
haxx:libcurl	haxx libcurl	eq	7.40.0