The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.

OSVersionArchitecturePackageVersionFilename
Debian12allcurl< 7.47.0-1curl_7.47.0-1_all.deb
Debian11allcurl< 7.47.0-1curl_7.47.0-1_all.deb
Debian10allcurl< 7.47.0-1curl_7.47.0-1_all.deb
Debian999allcurl< 7.47.0-1curl_7.47.0-1_all.deb
Debian13allcurl< 7.47.0-1curl_7.47.0-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	curl	< 7.47.0-1	curl_7.47.0-1_all.deb
Debian	11	all	curl	< 7.47.0-1	curl_7.47.0-1_all.deb
Debian	10	all	curl	< 7.47.0-1	curl_7.47.0-1_all.deb
Debian	999	all	curl	< 7.47.0-1	curl_7.47.0-1_all.deb
Debian	13	all	curl	< 7.47.0-1	curl_7.47.0-1_all.deb

nessus 49

openvas 45

amazon 3

cve 4

ubuntucve 4

prion 4

fedora 16

securityvulns 6

veracode 2

ubuntu 2

debiancve 3

slackware 2

debian 2

seebug 1

archlinux 3

mageia 2

ibm 14

openwrt 2

freebsd 1

f5 4

redhat 2

osv 1

centos 1

oraclelinux 1

alpinelinux 1

vmware 2

suse 1

gentoo 1

rosalinux 1

photon 2

apple 2

oracle 3

nessus

EulerOS Virtualization for ARM 64 3.0.2.0 : curl (EulerOS-SA-2019-1696)

2019-07-09 00:00:00

Amazon Linux AMI : curl (ALAS-2016-652)

2016-02-10 00:00:00

EulerOS 2.0 SP5 : curl (EulerOS-SA-2019-1665)

2019-06-27 00:00:00

openvas

Amazon Linux: Security Advisory (ALAS-2016-652)

2016-02-11 00:00:00

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2019-1696)

2020-01-23 00:00:00

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2019-1665)

2020-01-23 00:00:00

amazon

Low: curl

2016-02-09 13:30:00

Medium: curl

2014-02-26 16:51:00

Medium: curl

2014-04-10 23:54:00

cve

CVE-2016-0755

2016-01-29 20:59:00

CVE-2014-0015

2014-02-02 00:55:00

CVE-2015-3143

2015-04-24 14:59:00

ubuntucve

CVE-2016-0755

2016-01-27 00:00:00

CVE-2014-0015

2014-01-31 00:00:00

CVE-2014-0138

2014-03-27 00:00:00

prion

Design/Logic Flaw

2016-01-29 20:59:00

Cross site request forgery (csrf)

2014-02-02 00:55:00

Cross site request forgery (csrf)

2015-04-24 14:59:00

fedora

[SECURITY] Fedora 20 Update: curl-7.32.0-4.fc20

2014-02-03 02:46:56

[SECURITY] Fedora 23 Update: curl-7.43.0-5.fc23

2016-01-30 18:26:53

[SECURITY] Fedora 23 Update: mingw-curl-7.47.0-1.fc23

2016-02-17 04:02:22

securityvulns

[SECURITY] [DSA 2849-1] curl security update

2014-02-01 00:00:00

NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

2014-12-11 00:00:00

cURL security vulnerabilitiies

2015-11-01 00:00:00

veracode

Authentication Bypass

2019-01-15 08:51:58

Authentication Bypass

2021-07-05 07:20:24

ubuntu

curl vulnerability

2014-02-03 00:00:00

curl vulnerability

2016-01-27 00:00:00

debiancve

CVE-2014-0015

2014-02-02 00:55:00

CVE-2014-0138

2014-04-15 14:55:00

CVE-2015-3143

2015-04-24 14:59:00

slackware

curl

2014-02-13 16:38:20

[slackware-security] curl

2016-02-08 23:36:17

debian

[SECURITY] [DSA 2849-1] curl security update

2014-01-31 07:47:19

[SECURITY] [DSA 3455-1] curl security update

2016-01-27 12:16:15

seebug

cURL/libcURL NTLM连接远程安全限制绕过漏洞

2014-02-24 00:00:00

archlinux

curl: authentication bypass

2016-02-02 00:00:00

lib32-curl: authentication bypass

2016-02-02 00:00:00

curl: multiple issues

2015-04-24 00:00:00

mageia

Updated curl packages fix security vulnerability

2016-02-05 20:26:09

Updated curl packages fix multiple vulnerabilities

2014-04-03 04:56:35

ibm

Security Bulletin: Vulnerability in Libcurl affects IBM Integrated Management Module II (IMM2) for System x, Flex and BladeCenter systems (CVE-2016-0755)

2023-04-14 14:32:25

Security Bulletin: Vulnerability in Libcurl affects IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch firmware (CVE-2016-0755)

2019-01-31 02:25:02

Security Bulletin: IBM Flex System Manager (FSM) is affected by a curl vulnerability (CVE-2016-0755)

2018-06-18 01:32:46

openwrt

curl: Security update (CVE-2016-0755)

2016-03-02 11:23:11

wolfssl: Security update (2 CVEs)

2016-03-02 11:23:10

freebsd

curl -- Credentials not checked

2016-01-27 00:00:00

K16704 : cURL and libcurl vulnerability CVE-2015-3143

2015-05-29 00:00:00

SOL16704 - cURL and libcurl vulnerability CVE-2015-3143

2015-05-29 00:00:00

K15862 : Multiple cURL and libcurl vulnerabilities CVE-2014-0015, CVE-2014-0138, and CVE-2014-0139

2014-11-25 00:00:00

redhat

(RHSA-2014:0561) Moderate: curl security and bug fix update

2014-05-27 00:00:00

(RHSA-2014:0629) Important: rhev-hypervisor6 security update

2014-06-05 00:00:00

osv

CVE-2014-0138

2014-04-15 14:55:00

centos

curl, libcurl security update

2014-05-28 12:52:04

oraclelinux

curl security and bug fix update

2014-05-27 00:00:00

alpinelinux

CVE-2014-0138

2014-04-15 14:55:00

vmware

VMware vSphere product updates address security vulnerabilities

2014-12-04 00:00:00

VMware vSphere product updates address security vulnerabilities

2014-12-04 00:00:00

suse

Security update for sles11sp4-docker-image (important)

2016-03-15 21:11:47

gentoo

cURL: Multiple vulnerabilities

2017-01-19 00:00:00

rosalinux

Advisory ROSA-SA-2021-1818

2021-07-02 16:36:57

photon

Critical Photon OS Security Update - PHSA-2023-4.0-0420

2023-07-05 00:00:00

Critical Photon OS Security Update - PHSA-2023-3.0-0603

2023-06-26 00:00:00

apple

About the security content of macOS Sierra 10.12 - Apple Support

2017-01-23 05:36:06

About the security content of macOS Sierra 10.12

2016-09-20 00:00:00

oracle

Oracle Critical Patch Update Advisory - January 2015

2015-03-10 00:00:00

Oracle Critical Patch Update Advisory - July 2015

2015-07-14 00:00:00

Oracle Critical Patch Update - October 2018

2018-12-18 00:00:00

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.017 Low

EPSS

Percentile

87.6%

JSON

Related for DEBIANCVE:CVE-2016-0755