CVE-2015-3144

high · 9

The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."

CVSS

11.0%

EPSS (exploit prob.)

96th

EPSS percentile

2015-04-24

Published

AV:N/AC:L/Au:S/C:C/I:C/A:C

Weaknesses

CWE-119

Affected products

Vendor	Product	Affected versions
oracle	mysql_enterprise_monitor	<= 2.3.20
oracle	mysql_enterprise_monitor	<= 3.0.22
haxx	curl	7.37.0
haxx	curl	7.37.1
haxx	curl	7.38.0
haxx	curl	7.39.0
haxx	curl	7.40.0
haxx	curl	7.41.0
haxx	libcurl	7.37.0
haxx	libcurl	7.37.1
haxx	libcurl	7.38.0
haxx	libcurl	7.39
haxx	libcurl	7.40.0
haxx	libcurl	7.41.0
canonical	ubuntu_linux	12.04
canonical	ubuntu_linux	14.04
canonical	ubuntu_linux	14.10
canonical	ubuntu_linux	15.04
debian	debian_linux	7.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2015-3144