CVE-2016-9952

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted wildcard SAN in a server certificate, as demonstrated by "*.com."

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
haxx	curl	>= 7.27.0, <= 7.51.0

References

https://curl.haxx.se/CVE-2016-9952.patchVendor Advisory
https://curl.haxx.se/docs/adv_20161221B.htmlVendor Advisory
https://curl.haxx.se/CVE-2016-9952.patchVendor Advisory
https://curl.haxx.se/docs/adv_20161221B.htmlVendor Advisory

Timeline

Published: Mar 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-99539.8The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS ba CVE-2016-99547.5The backtrack compilation code in the Irregex package (aka IrRegular Expressions) before 0.9.6 for Scheme allows remote attackers to cause a CVE-2016-99556.3The SimpleSAML_XML_Validator class constructor in SimpleSAMLphp before 1.14.11 might allow remote attackers to spoof signatures on SAML 1 re CVE-2016-99567.5The route manager in FlightGear before 2016.4.4 allows remote attackers to write to arbitrary files via a crafted Nasal script.CVE-2016-99577.8Stack-based buffer overflow in game-music-emu before 0.6.1.CVE-2016-99587.8game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations.CVE-2016-99597.8game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.CVE-2016-99605.5game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash).CVE-2016-99619.8game-music-emu before 0.6.1 mishandles unspecified integer values.CVE-2016-99626.4RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of CVE-2016-99635.9Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.CVE-2016-99646.5redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233