CVE-2016-8623

The documents confirm CVE-2016-8623 affects curl prior to 7.51.0, where the cookie handling allows a use-after-free across threads that can disclose information. The issue is rooted in how curl collects/sends cookies, releasing the cookie lock while returning a list of references, enabling anothe...

CVE-2016-8616

A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped...

CVE-2016-8619

CVE-2016-8619 affects curl, where the Kerberos authentication path reads length fields and realloc() may be called with 0, leading to a memory double-free. This issue is documented across multiple sources (Debian DSA-3705-1 and ALAS-2016-766), identifying the vulnerable code path as read_data() i...

CVE-2016-8620

CVE-2016-8620 concerns curl’s globbing feature, where parsing numeric ranges could write beyond allocated memory and read out-of-bounds. The issue affects the curl tool (not libcurl) and could enable remote code execution or unintended behavior when handling invalid ranges; it may also enable out...

CVE-2016-8620

The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input...

CVE-2016-8615

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar...

CVE-2016-8620

The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input...

CVE-2016-8623

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure...

CVE-2016-8615

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar...

CVE-2016-8620

The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input...

CVE-2016-8623

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure...

CVE-2016-8623

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure...

CVE-2016-8623

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure...

CVE-2016-8619

The function readdata in security.c in curl before version 7.51.0 is vulnerable to memory double free...

CVE-2016-8625

CVE-2016-8625 affects curl/libcurl prior to 7.51.0 when built with libidn, using IDNA 2003 instead of IDNA 2008. This mismatch can cause requests to the wrong host. Impact described in connected docs includes remote code execution, cookie injection, and information disclosure via multiple vectors...

CVE-2016-8620

The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input...

CVE-2016-8615

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar...

CVE-2016-8616

A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped...

CVE-2016-8615

CVE-2016-8615 affects curl prior to 7.51.0, where if cookie state is written to a cookie jar and later read back, a malicious HTTP server can inject cookies for arbitrary domains. This cookie-jar handling issue is corroborated by Debian security advisories and Cloud Foundry USN entries, which des...

CVE-2016-8616

CVE-2016-8616 affects curl prior to 7.51.0. When re-using a connection, curl performed case-insensitive comparisons of the username and password against existing connections, enabling an attacker who knows the case-insensitive form of the correct password to cause reuse of an unused connection wi...