Vulnerabilities > Haxx

DATE CVE VULNERABILITY TITLE RISK
2015-06-22 CVE-2015-3236 Information Exposure vulnerability in Haxx Curl and Libcurl
cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.
network
low complexity
haxx CWE-200
5.0
2015-05-01 CVE-2015-3153 Information Exposure vulnerability in multiple products
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
network
low complexity
oracle haxx canonical apple debian CWE-200
5.0
2015-04-24 CVE-2015-3148 Improper Access Control vulnerability in multiple products
cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.
5.0
2015-04-24 CVE-2015-3145 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.
7.5
2015-04-24 CVE-2015-3144 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80." The previous CVSS assessment 7.5 (AV:N/AC:L/AU:N/C:P/I:P/A:P) was provided at the time of initial analysis based on the best available published information at that time.
network
low complexity
oracle haxx canonical debian CWE-119
critical
9.0
2015-04-24 CVE-2015-3143 Permissions, Privileges, and Access Controls vulnerability in multiple products
cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.
network
low complexity
haxx canonical debian hp apple CWE-264
5.0
2015-01-15 CVE-2014-8151 The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
network
apple haxx
5.8
2015-01-15 CVE-2014-8150 Remote Security Bypass vulnerability in cURL/libcURL
CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.
4.3
2014-11-18 CVE-2014-3620 Cryptographic Issues vulnerability in multiple products
cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.
network
low complexity
haxx apple CWE-310
5.0
2014-11-18 CVE-2014-3613 Cryptographic Issues vulnerability in multiple products
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.
network
low complexity
haxx apple CWE-310
5.0