curl / Docs / Vulnerability table / 6.4 vulnerabilities

Vulnerabilities in curl 6.4

Related:
Bug Bounty
Changelog
Donate
FAQ
Security Problems
Security Process
Vulnerabilities Table

curl version 6.4 was released on January 17 2000. The following 16 security problems are known to exist in this version.

Flaw	From version	To and including	CVE	CWE
Auth/cookie leak on redirect	4.9	7.82.0	CVE-2022-27776	CWE-522: Insufficiently Protected Credentials
Credential leak on redirect	4.9	7.82.0	CVE-2022-27774	CWE-522: Insufficiently Protected Credentials
trusting FTP PASV responses	4.0	7.73.0	CVE-2020-8284	CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
HTTP authentication leak in redirects	6.0	7.57.0	CVE-2018-1000007	CWE-522: Insufficiently Protected Credentials
printf floating point buffer overflow	5.4	7.51.0	CVE-2016-9586	CWE-121: Stack-based Buffer Overflow
cookie injection for other servers	4.9	7.50.3	CVE-2016-8615	CWE-187: Partial Comparison
double-free in curl_maprintf	5.4	7.50.3	CVE-2016-8618	CWE-415: Double Free
invalid URL parsing with '#'	6.0	7.50.3	CVE-2016-8624	CWE-172: Encoding Error
TLS session resumption client cert bypass	5.0	7.50.0	CVE-2016-5419	CWE-305: Authentication Bypass by Primary Weakness
sensitive HTTP server headers also sent to proxies	4.0	7.42.0	CVE-2015-3153	CWE-201: Information Exposure Through Sent Data
URL request injection	6.0	7.39.0	CVE-2014-8150	CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
cookie leak with IP address as domain	4.0	7.37.1	CVE-2014-3613	CWE-201: Information Exposure Through Sent Data
cookie domain tailmatch	6.0	7.29.0	CVE-2013-1944	CWE-201: Information Exposure Through Sent Data
Arbitrary File Access	6.0	7.19.3	CVE-2009-0037	CWE-142: Improper Neutralization of Value Delimiters
Proxy Authentication Header Information Leakage	4.5	7.10.6	CVE-2003-1605	CWE-201: Information Exposure Through Sent Data
FTP Server Response Buffer Overflow	6.0	7.4	CVE-2000-0973	CWE-121: Stack-based Buffer Overflow

Changelog for curl 6.4

See vulnerability summary for the previous release: 6.3.1 or the subsequent release: 6.5