curl / Docs / Vulnerability table / 7.1 vulnerabilities

Vulnerabilities in curl 7.1

Related:
Bug Bounty
Changelog
Donate
FAQ
Security Problems
Security Process
Vulnerabilities Table

curl version 7.1 was released on August 7 2000. The following 17 security problems are known to exist in this version.

Flaw	From version	To and including	CVE	CWE
HTTP authentication leak in redirects	6.0	7.57.0	CVE-2018-1000007	CWE-522: Insufficiently Protected Credentials
--write-out out of buffer read	6.5	7.53.1	CVE-2017-7407	CWE-126: Buffer Over-read
printf floating point buffer overflow	7.1	7.51.0	CVE-2016-9586	CWE-121: Stack-based Buffer Overflow
cookie injection for other servers	7.1	7.50.3	CVE-2016-8615	CWE-187: Partial Comparison
OOB write via unchecked multiplication	7.1	7.50.3	CVE-2016-8617	CWE-131: Incorrect Calculation of Buffer Size
double-free in curl_maprintf	7.1	7.50.3	CVE-2016-8618	CWE-415: Double Free
invalid URL parsing with '#'	7.1	7.50.3	CVE-2016-8624	CWE-172: Encoding Error
TLS session resumption client cert bypass	7.1	7.50.0	CVE-2016-5419	CWE-305: Authentication Bypass by Primary Weakness
Re-using connections with wrong client cert	7.1	7.50.0	CVE-2016-5420	CWE-305: Authentication Bypass by Primary Weakness
sensitive HTTP server headers also sent to proxies	7.1	7.42.0	CVE-2015-3153	CWE-201: Information Exposure Through Sent Data
URL request injection	6.0	7.39.0	CVE-2014-8150	CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
cookie leak with IP address as domain	7.1	7.37.1	CVE-2014-3613	CWE-201: Information Exposure Through Sent Data
IP address wildcard certificate validation	7.1	7.35.0	CVE-2014-0139	CWE-297: Improper Validation of Certificate with Host Mismatch
cookie domain tailmatch	6.0	7.29.0	CVE-2013-1944	CWE-201: Information Exposure Through Sent Data
Arbitrary File Access	6.0	7.19.3	CVE-2009-0037	CWE-142: Improper Neutralization of Value Delimiters
Proxy Authentication Header Information Leakage	7.1	7.10.6	CVE-2003-1605	CWE-201: Information Exposure Through Sent Data
FTP Server Response Buffer Overflow	6.0	7.4	CVE-2000-0973	CWE-121: Stack-based Buffer Overflow

Changelog for curl 7.1

See vulnerability summary for the previous release: 6.5.2 or the subsequent release: 7.1.1