CVE-2012-0036

curl and libcurl 7.2x < 7.24.0 - Data Injection via URL Pathname Extraction

Title source: llm
STIX 2.1

Description

curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol.

References (15)

Core 15
Core References
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2012/May/msg00001.html
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201203-02.xml
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1032924
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2012/dsa-2398
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/51665
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/48256
Vendor Advisory x_refsource_confirm
http://curl.haxx.se/docs/adv_20120124.html
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2012:058
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=773457
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT5281

Scores

EPSS 0.1672
EPSS Percentile 96.7%

Details

CWE
CWE-89
Status published
Products (26)
curl/curl 7.20.0
curl/curl 7.20.1
curl/curl 7.21.0
curl/curl 7.21.1
curl/curl 7.21.2
curl/curl 7.21.3
curl/curl 7.21.4
curl/curl 7.21.5
curl/curl 7.21.6
curl/curl 7.21.7
... and 16 more
Published Apr 13, 2012
Tracked Since Feb 18, 2026