CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
Confidence
High
EPSS
Percentile
78.0%
Package : curl
Version : 7.21.0-2.1+squeeze11
CVE ID : CVE-2014-8150
Andrey Labunets of Facebook discovered that cURL, an URL transfer
library, fails to properly handle URLs with embedded end-of-line
characters. An attacker able to make an application using libcurl to
access a specially crafted URL via an HTTP proxy could use this flaw to
do additional requests in a way that was not intended, or insert
additional request headers into the request.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 7 | mipsel | curl | < 7.26.0-1+wheezy12 | curl_7.26.0-1+wheezy12_mipsel.deb |
Debian | 7 | mipsel | libcurl3-nss | < 7.26.0-1+wheezy12 | libcurl3-nss_7.26.0-1+wheezy12_mipsel.deb |
Debian | 7 | mips | libcurl4-nss-dev | < 7.26.0-1+wheezy12 | libcurl4-nss-dev_7.26.0-1+wheezy12_mips.deb |
Debian | 7 | amd64 | curl | < 7.26.0-1+wheezy12 | curl_7.26.0-1+wheezy12_amd64.deb |
Debian | 7 | kfreebsd-i386 | libcurl3-nss | < 7.26.0-1+wheezy12 | libcurl3-nss_7.26.0-1+wheezy12_kfreebsd-i386.deb |
Debian | 7 | kfreebsd-i386 | libcurl4-openssl-dev | < 7.26.0-1+wheezy12 | libcurl4-openssl-dev_7.26.0-1+wheezy12_kfreebsd-i386.deb |
Debian | 7 | sparc | libcurl3-dbg | < 7.26.0-1+wheezy12 | libcurl3-dbg_7.26.0-1+wheezy12_sparc.deb |
Debian | 6 | amd64 | libcurl3-gnutls | < 7.21.0-2.1+squeeze11 | libcurl3-gnutls_7.21.0-2.1+squeeze11_amd64.deb |
Debian | 7 | s390x | libcurl4-nss-dev | < 7.26.0-1+wheezy12 | libcurl4-nss-dev_7.26.0-1+wheezy12_s390x.deb |
Debian | 6 | amd64 | libcurl3-dbg | < 7.21.0-2.1+squeeze11 | libcurl3-dbg_7.21.0-2.1+squeeze11_amd64.deb |