Description
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
Metrics
CVSS 2.0 5.0/10
AV:N/AC:L/Au:N/C:P/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://curl.haxx.se/docs/adv_20150429.htmlVendor Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html
- http://www.debian.org/security/2015/dsa-3240Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlPatch, Third Party Advisory
- http://www.securityfocus.com/bid/74408
- http://www.securitytracker.com/id/1032233Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2591-1Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10131
- https://support.apple.com/kb/HT205031Third Party Advisory
- http://curl.haxx.se/docs/adv_20150429.htmlVendor Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html
- http://www.debian.org/security/2015/dsa-3240Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlPatch, Third Party Advisory
- http://www.securityfocus.com/bid/74408
- http://www.securitytracker.com/id/1032233Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2591-1Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10131
- https://support.apple.com/kb/HT205031Third Party Advisory
Timeline
- Published
- May 1, 2015
- Last modified
- Jun 17, 2026
- NVD status
- Modified