curl / Docs / Vulnerability table / 7.15.4 vulnerabilities

Vulnerabilities in curl 7.15.4

curl version 7.15.4 was released on June 12 2006. The following 54 security problems are known to exist in this version.

Flaw	From version	To and including
cookie injection with none file	7.9.1	8.3.0
more POST-after-PUT confusion	7.7	8.0.1
IDN wildcard match	7.12.0	8.0.1
siglongjmp race condition	7.9.8	8.0.1
FTP too eager connection reuse	7.13.0	7.88.1
TELNET option IAC injection	7.7	7.88.1
POST following PUT confusion	7.7	7.85.0
control code in cookie denial of service	4.9	7.84.0
Auth/cookie leak on redirect	4.9	7.82.0
Credential leak on redirect	4.9	7.82.0
TELNET stack contents disclosure again	7.7	7.77.0
Bad connection reuse due to flawed path name checks	7.10.4	7.77.0
TELNET stack contents disclosure	7.7	7.76.1
Automatic referer leaks credentials	7.1.1	7.75.0
trusting FTP PASV responses	4.0	7.73.0
warning message out-of-buffer read	7.14.1	7.61.1
NTLM password overflow via integer overflow	7.15.4	7.61.0
FTP path trickery leads to NIL byte out of bounds write	7.12.3	7.58.0
HTTP authentication leak in redirects	6.0	7.57.0
FTP PWD response parser out of bounds read	7.7	7.55.1
TFTP sends more than buffer size	7.15.0	7.54.1
--write-out out of buffer read	6.5	7.53.1
printf floating point buffer overflow	5.4	7.51.0
cookie injection for other servers	4.9	7.50.3
case insensitive password comparison	7.7	7.50.3
OOB write via unchecked multiplication	7.8.1	7.50.3
double free in curl_maprintf	5.4	7.50.3
double free in krb5 code	7.3	7.50.3
curl_getdate read out of bounds	7.12.2	7.50.3
Use after free via shared cookies	7.10.7	7.50.3
invalid URL parsing with '#'	6.0	7.50.3
IDNA 2003 makes curl use wrong host	7.12.0	7.50.3
curl escape and unescape integer overflows	7.11.1	7.50.2
TLS session resumption client cert bypass	5.0	7.50.0
Re-using connections with wrong client cert	7.7	7.50.0
Windows DLL hijacking	7.11.1	7.49.0
remote file name path traversal in curl tool for Windows	4.0	7.46.0
NTLM credentials not-checked for proxy connection re-use	7.10.7	7.46.0
sensitive HTTP server headers also sent to proxies	4.0	7.42.0
Negotiate not treated as connection-oriented	7.10.6	7.41.0
Re-using authenticated connection when unauthenticated	7.10.6	7.41.0
URL request injection	6.0	7.39.0
cookie leak with IP address as domain	4.0	7.37.1
IP address wildcard certificate validation	7.10.3	7.35.0
wrong re-use of connections	7.10.6	7.35.0
re-use of wrong HTTP NTLM connection	7.10.6	7.34.0
URL decode buffer boundary flaw	7.7	7.30.0
cookie domain tailmatch	4.7	7.29.0
SSL CBC IV vulnerability	7.10.6	7.23.1
inappropriate GSSAPI delegation	7.10.6	7.21.6
data callback excessive length	7.10.5	7.19.7
embedded zero in cert name	7.4	7.19.5
Arbitrary File Access	5.11	7.19.3
GnuTLS insufficient cert verification	7.14.0	7.16.3

CVE data for 7.15.4 provided as JSON.

Changelog for curl 7.15.4

See vulnerability summary for the previous release: 7.15.3 or the subsequent release: 7.15.5