curl: Cookie injection for other servers

🗓️ 16 Aug 2018 16:06:16Reported by RedHatType

Curl before 7.51 has a cookie jar injection flaw enabling a malicious server to inject cookies for arbitrary domains.

Reporter	Title	Published	Views	Family All 132
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL affect IBM Flex System Chassis Management Module (CMM)	31 Jan 201902:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in curl affect IBM Flex System Manager (FSM)	18 Jun 201801:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Dynamic System Analysis (DSA) Preboot is affected by vulnerabilities in curl	31 Jan 201902:25	–	ibm
FreeBSD	cURL -- multiple vulnerabilities	2 Nov 201600:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 8 package curl version 7.51.0-alt1	2 Nov 201600:00	–	altlinux
Tenable Nessus	cURL/libcurl 7.x < 7.51.0 Multiple Vulnerabilities	9 Dec 201600:00	–	nessus
Tenable Nessus	Amazon Linux AMI : curl (ALAS-2016-766)	11 Nov 201600:00	–	nessus
Tenable Nessus	Debian DLA-711-1 : curl security update	18 Nov 201600:00	–	nessus
Tenable Nessus	Debian DSA-3705-1 : curl - security update	7 Nov 201600:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP2 : curl (EulerOS-SA-2017-1035)	1 May 201700:00	–	nessus

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2016-8615
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
curl	www.curl.haxx.se/docs/adv_20161102A.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2016-8615
cve	www.cve.org/CVERecord

30 Jun 2026 11:42Current

7.4High risk

Vulners AI Score7.4

CVSS 25

CVSS 35.3 - 7.5

EPSS0.04498

SSVC