CVE-2015-3144
24.04.2015, 14:59
The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| oracle | mysql_enterprise_monitor | 𝑥 ≤ 2.3.20 |
| oracle | mysql_enterprise_monitor | 𝑥 ≤ 3.0.22 |
| haxx | curl | 7.37.0 |
| haxx | curl | 7.37.1 |
| haxx | curl | 7.38.0 |
| haxx | curl | 7.39.0 |
| haxx | curl | 7.40.0 |
| haxx | curl | 7.41.0 |
| haxx | libcurl | 7.37.0 |
| haxx | libcurl | 7.37.1 |
| haxx | libcurl | 7.38.0 |
| haxx | libcurl | 7.39 |
| haxx | libcurl | 7.40.0 |
| haxx | libcurl | 7.41.0 |
| canonical | ubuntu_linux | 12.04 |
| canonical | ubuntu_linux | 14.04 |
| canonical | ubuntu_linux | 14.10 |
| canonical | ubuntu_linux | 15.04 |
| debian | debian_linux | 7.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| curl |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| libcurl-devel |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| libcurl4 |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| libcurl4-32bit |
|
Common Weakness Enumeration
References