The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.

OSVersionArchitecturePackageVersionFilename
Debian12allcurl< 7.36.0-1curl_7.36.0-1_all.deb
Debian11allcurl< 7.36.0-1curl_7.36.0-1_all.deb
Debian10allcurl< 7.36.0-1curl_7.36.0-1_all.deb
Debian999allcurl< 7.36.0-1curl_7.36.0-1_all.deb
Debian13allcurl< 7.36.0-1curl_7.36.0-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	curl	< 7.36.0-1	curl_7.36.0-1_all.deb
Debian	11	all	curl	< 7.36.0-1	curl_7.36.0-1_all.deb
Debian	10	all	curl	< 7.36.0-1	curl_7.36.0-1_all.deb
Debian	999	all	curl	< 7.36.0-1	curl_7.36.0-1_all.deb
Debian	13	all	curl	< 7.36.0-1	curl_7.36.0-1_all.deb

nessus 43

osv 2

redhat 2

centos 1

oraclelinux 1

openvas 44

amazon 3

ubuntucve 4

prion 4

fedora 15

alpinelinux 1

cve 4

f5 4

mageia 1

ibm 10

debiancve 3

securityvulns 8

veracode 2

ubuntu 2

slackware 2

debian 3

seebug 1

gentoo 1

vmware 2

archlinux 1

ics 1

oracle 2

nessus

Amazon Linux AMI : curl (ALAS-2014-322)

2014-04-23 00:00:00

Scientific Linux Security Update : curl on SL6.x i386/x86_64 (20140527)

2014-05-28 00:00:00

RHEL 6 : curl (RHSA-2014:0561)

2014-05-28 00:00:00

osv

CVE-2014-0138

2014-04-15 14:55:00

curl - security update

2014-04-13 00:00:00

redhat

(RHSA-2014:0561) Moderate: curl security and bug fix update

2014-05-27 00:00:00

(RHSA-2014:0629) Important: rhev-hypervisor6 security update

2014-06-05 00:00:00

centos

curl, libcurl security update

2014-05-28 12:52:04

oraclelinux

curl security and bug fix update

2014-05-27 00:00:00

openvas

Fedora Update for curl FEDORA-2014-4436

2014-04-03 00:00:00

Amazon Linux: Security Advisory (ALAS-2014-322)

2015-09-08 00:00:00

Fedora Update for curl FEDORA-2014-4436

2014-04-03 00:00:00

amazon

Medium: curl

2014-04-10 23:54:00

Medium: curl

2014-02-26 16:51:00

Low: curl

2016-02-09 13:30:00

ubuntucve

CVE-2014-0138

2014-03-27 00:00:00

CVE-2014-0015

2014-01-31 00:00:00

CVE-2016-0755

2016-01-27 00:00:00

prion

Default configuration

2014-04-15 14:55:00

Cross site request forgery (csrf)

2014-02-02 00:55:00

Cross site request forgery (csrf)

2015-04-24 14:59:00

fedora

[SECURITY] Fedora 20 Update: curl-7.32.0-8.fc20

2014-03-31 02:15:35

[SECURITY] Fedora 19 Update: curl-7.29.0-17.fc19

2014-03-31 02:12:04

[SECURITY] Fedora 20 Update: curl-7.32.0-4.fc20

2014-02-03 02:46:56

alpinelinux

CVE-2014-0138

2014-04-15 14:55:00

cve

CVE-2014-0138

2014-04-15 14:55:00

CVE-2014-0015

2014-02-02 00:55:00

CVE-2015-3143

2015-04-24 14:59:00

K15862 : Multiple cURL and libcurl vulnerabilities CVE-2014-0015, CVE-2014-0138, and CVE-2014-0139

2014-11-25 00:00:00

SOL15862 - Multiple cURL and libcurl vulnerabilities CVE-2014-0015, CVE-2014-0138, and CVE-2014-0139

2014-11-25 00:00:00

K16704 : cURL and libcurl vulnerability CVE-2015-3143

2015-05-29 00:00:00

mageia

Updated curl packages fix multiple vulnerabilities

2014-04-03 04:56:35

ibm

Security Bulletin: IBM ToolsCenter is affected by several cURL potential vulnerabilities (CVE-2014-0015, CVE-2014-0139, CVE-2014-0138, CVE-2014-2522)

2019-01-31 01:25:01

Security Bulletin: Vulnerabilities in cURL affect System x Integrated Management Module (IMM) (CVE-2013-2174, CVE-2014-0015, CVE-2014-138, CVE-2014-0139)

2019-01-31 01:35:01

Security Bulletin: Vulnerabilities in cURL affect System x Integrated Management Module (IMM) (CVE-2013-2174, CVE-2014-0015, CVE-2014-0138, CVE-2014-0139)

2019-01-31 01:35:01

debiancve

CVE-2014-0015

2014-02-02 00:55:00

CVE-2016-0755

2016-01-29 20:59:00

CVE-2015-3143

2015-04-24 14:59:00

securityvulns

[SECURITY] [DSA 2849-1] curl security update

2014-02-01 00:00:00

NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

2014-12-11 00:00:00

curl multiple security vulnerabilities

2014-04-01 00:00:00

veracode

Authentication Bypass

2019-01-15 08:51:58

Insecure Defaults

2018-08-14 06:19:27

ubuntu

curl vulnerability

2014-02-03 00:00:00

curl vulnerabilities

2014-04-14 00:00:00

slackware

curl

2014-02-13 16:38:20

[slackware-security] curl

2014-03-28 22:53:36

debian

[SECURITY] [DSA 2849-1] curl security update

2014-01-31 07:47:19

[SECURITY] [DSA 2902-1] curl security update

2014-04-13 08:26:48

[SECURITY] [DSA 2902-1] curl security update

2014-04-13 08:26:48

seebug

cURL/libcURL NTLM连接远程安全限制绕过漏洞

2014-02-24 00:00:00

gentoo

cURL: Multiple vulnerabilities

2014-06-22 00:00:00

vmware

VMware vSphere product updates address security vulnerabilities

2014-12-04 00:00:00

VMware vSphere product updates address security vulnerabilities

2014-12-04 00:00:00

archlinux

curl: multiple issues

2015-04-24 00:00:00

ics

Hitachi Energy MSM Product

2022-08-30 12:00:00

oracle

Oracle Critical Patch Update Advisory - July 2015

2015-07-14 00:00:00

Oracle Critical Patch Update Advisory - January 2015

2015-03-10 00:00:00

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.006 Low

EPSS

Percentile

78.6%

JSON

Related for DEBIANCVE:CVE-2014-0138