CVE-2016-9594

EUVD-2016-10398
curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value.  Having a weak or virtually non-existent random value makes the operations that use it vulnerable.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
redhatCNA
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 77%
Affected Products (NVD)
VendorProductVersion
haxxcurl
𝑥
< 7.52.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
curl
bookworm
7.88.1-10+deb12u7
fixed
bookworm (security)
7.88.1-10+deb12u5
fixed
bullseye
7.74.0-1.3+deb11u13
fixed
bullseye (security)
7.74.0-1.3+deb11u11
fixed
sid
8.10.1-2
fixed
trixie
8.10.1-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
curl
precise
not-affected
trusty
not-affected
xenial
not-affected
yakkety
not-affected
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/95094
http://www.securitytracker.com/id/1037528
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9594
https://curl.haxx.se/docs/adv_20161223.html
https://security.gentoo.org/glsa/201701-47
https://www.tenable.com/security/tns-2017-04
http://www.securityfocus.com/bid/95094
http://www.securitytracker.com/id/1037528
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9594
https://curl.haxx.se/docs/adv_20161223.html
https://security.gentoo.org/glsa/201701-47
https://www.tenable.com/security/tns-2017-04