CVE-2015-3236

cURL & libcurl <7.43 - Info Disclosure

Title source: llm
STIX 2.1

Description

cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.

References (10)

Core 10
Core References
Vendor Advisory x_refsource_confirm
http://curl.haxx.se/docs/adv_20150617A.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160660.html
Patch, Third Party Advisory x_refsource_confirm
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
Patch, Third Party Advisory x_refsource_confirm
http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/75385
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/91787
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201509-02

Scores

EPSS 0.0452
EPSS Percentile 89.3%

Details

CWE
CWE-200
Status published
Products (8)
haxx/curl 7.40.0
haxx/curl 7.41.0
haxx/curl 7.42.0
haxx/curl 7.42.1
haxx/libcurl 7.40.0
haxx/libcurl 7.41.0
haxx/libcurl 7.42.0
haxx/libcurl 7.42.1
Published Jun 22, 2015
Tracked Since Feb 18, 2026