Vulnerabilities > Haxx > Curl > 6.0
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-08-01 | CVE-2016-8615 | Resource Injection vulnerability in Haxx Curl A flaw was found in curl before version 7.51. | 7.5 |
| 2018-07-31 | CVE-2016-8621 | Out-of-bounds Read vulnerability in Haxx Curl The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short. | 7.5 |
| 2018-07-31 | CVE-2016-8617 | Out-of-bounds Write vulnerability in Haxx Curl The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`. | 7.0 |
| 2018-07-31 | CVE-2016-8624 | Improper Input Validation vulnerability in Haxx Curl curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. | 7.5 |
| 2018-07-31 | CVE-2016-8618 | Double Free vulnerability in Haxx Curl The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables. | 9.8 |
| 2018-07-27 | CVE-2017-2629 | Improper Certificate Validation vulnerability in Haxx Curl curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. | 4.0 |
| 2018-04-23 | CVE-2016-9594 | Improper Initialization vulnerability in Haxx Curl curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. | 8.1 |
| 2018-04-23 | CVE-2016-9586 | Heap-based Buffer Overflow vulnerability in Haxx Curl curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. | 8.1 |
| 2017-06-14 | CVE-2017-9502 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Haxx Curl In curl before 7.54.1 on Windows and DOS, libcurl's default protocol function, which is the logic that allows an application to set which protocol libcurl should attempt to use when given a URL without a scheme part, had a flaw that could lead to it overwriting a heap based memory buffer with seven bytes. | 5.0 |
| 2016-06-24 | CVE-2016-4802 | Permissions, Privileges, and Access Controls vulnerability in Haxx Curl Multiple untrusted search path vulnerabilities in cURL and libcurl before 7.49.1, when built with SSPI or telnet is enabled, allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) security.dll, (2) secur32.dll, or (3) ws2_32.dll in the application or current working directory. | 6.9 |