KLA10566 Multiple vulnerabilities in cURL

Multiple serious vulnerabilities have been found in cURL. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service or conduct other unknown impact.

Below is a complete list of vulnerabilities

1. Improper re-use of authenticated Negotiate and NTLM connections can be exploited remotely via a specially designed request;
2. An improper index calculation can be exploited remotely via a specially designed cookie or host name.

Original advisories

cURL advisory

cURL advisory

cURL advisory

cURL advisory

Related products

cURL

CVE list

CVE-2015-3148 critical

CVE-2015-3145 critical

CVE-2015-3143 critical

CVE-2015-3144 critical

Solution

Update ti the latest version

Get cURL

Impacts

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• cURL and libcurl versions from 7.10.6 through 7.41.0