CVE-2015-3153

cURL <7.42.1 - Info Disclosure

Title source: llm

Description

The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.

References (14)

Core 14

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1032233

Patch, Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Patch, Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-2591-1

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html