NetSight
IP …
high7.5

CVE-2015-3145

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a deni…

Impact

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.

Affected products

VendorProductAffected versions
FedoraprojectFedora
Versions 21, 22
CanonicalUbuntu Linux
Versions 12.04, 14.04, 14.10, 15.04
DebianDebian Linux
Version 7.0
HaxxCurl
Versions 7.31.0, 7.32.0, 7.33.0, 7.34.0, 7.35.0, 7.36.0
AppleMac Os X
Versions 10.10.0, 10.10.1, 10.10.2, 10.10.3, 10.10.4
OracleSolaris
Version 11.3
HaxxLibcurl
Versions 7.30.0, 7.31.0, 7.32.0, 7.33.0, 7.34.0, 7.35.0
HpSystem Management Homepage
through 7.5.3.1
OpensuseOpensuse
Versions 13.1, 13.2

Weakness classification

CWE-119

References