NetSight
IP …
critical9.0

CVE-2015-3144

The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of se…

Impact

The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."

Affected products

VendorProductAffected versions
OracleMysql Enterprise Monitor
through 2.3.20
through 3.0.22
HaxxCurl
Versions 7.37.0, 7.37.1, 7.38.0, 7.39.0, 7.40.0, 7.41.0
HaxxLibcurl
Versions 7.37.0, 7.37.1, 7.38.0, 7.39, 7.40.0, 7.41.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 14.10, 15.04
DebianDebian Linux
Version 7.0

Weakness classification

CWE-119

References