CVE-2015-3153

The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents...

CVE-2015-3153

Technical details for CVE-2015-3153 are not provided in the connected documents. Monitor for updates; the available material only includes the initial summary of impact without vendor/product specifics.

CVE-2015-3153

The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents...

Ubuntu: Security Advisory (USN-2591-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS : curl vulnerabilities (USN-2591-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2591-1 advisory. Paras Sethia discovered that curl could incorrectly re-use NTLM HTTP credentials when subsequently connecting to the same host over HTTP. CVE-2015-3143...

openSUSE Security Update : curl (openSUSE-2015-336)

curl was updated to fix four security issues. The following vulnerabilities were fixed : - CVE-2015-3143: curl could re-use NTML authenticateds connections - CVE-2015-3144: curl could access memory out of bounds with zero length host names - CVE-2015-3145: curl cookie parser could access memory o...

Debian DLA-211-1 : curl security update

Several vulnerabilities were discovered in cURL, an URL transfer library : CVE-2015-3143 NTLM-authenticated connections could be wrongly reused for requests without any credentials set, leading to HTTP requests being sent over the connection authenticated as a different user. This is similar to t...

Mandriva Linux Security Advisory : lftp (MDVSA-2015:213)

Updated lftp packages fix security vulnerability : lftp incorrectly validates wildcard SSL certificates containing literal IP addresses, so under certain conditions, it would allow and use a wildcard match specified in the CN field, allowing a malicious server to participate in a MITM attack or...

Debian DSA-3240-1 : curl - security update

It was discovered that cURL, an URL transfer library, if configured to use a proxy server with the HTTPS protocol, by default could send to the proxy the same HTTP headers it sends to the destination server, possibly leaking sensitive information. %NASLMINLEVEL 70300 C Tenable Network Security,...

[SECURITY] [DLA 211-1] curl security update

Package : curl Version : 7.21.0-2.1+squeeze12 CVE ID : CVE-2015-3143 CVE-2015-3148 Several vulnerabilities were discovered in cURL, an URL transfer library: CVE-2015-3143 NTLM-authenticated connections could be wrongly reused for requests without any credentials set, leading to HTTP requests bein...

SUSE-SU-2015:0990-1 Security update for curl

curl was updated to fix five security issues. The following vulnerabilities were fixed: CVE-2015-3143: curl could re-use NTML authenticateds connections CVE-2015-3144: curl could access memory out of bounds with zero length host names CVE-2015-3145: curl cookie parser could access memory out of...

[SECURITY] [DSA 3240-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3240-1 [email protected] http://www.debian.org/security/ Alessandro Ghedini April 29, 2015 http://www.debian.org/security/faq -...

sensitive HTTP server headers also sent to proxies

libcurl provides applications a way to set custom HTTP headers to be sent to the server by using CURLOPTHTTPHEADER. A similar option is available for the curl command-line tool with the '--header' option. When the connection passes through an HTTP proxy the same set of headers is sent to the prox...

Security fix for the ALT Linux 8 package curl version 7.42.1-alt1

April 29, 2015 Anton Farygin 7.42.1-alt1 - new version, with fixes for CVE-2015-3153...

DSA-3240-1 curl - security update

Bulletin has no description...

Fedora Update for curl FEDORA-2015-6712

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-3153

The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents...

UBUNTU-CVE-2015-3153

The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents...

DLA-211-1 curl - security update

Bulletin has no description...

Debian Security Advisory DSA 3240-1 (curl - security update)

It was discovered that cURL, an URL transfer library, if configured to use a proxy server with the HTTPS protocol, by default could send to the proxy the same HTTP headers it sends to the destination server, possibly leaking sensitive information. OpenVAS Vulnerability Test $Id: deb3240.nasl 6609...