curl / Docs / Vulnerability table / 7.54.0 vulnerabilities

Vulnerabilities in curl 7.54.0

curl version 7.54.0 was released on April 19 2017

It has the following 60 published security problems.

Flaw	From version	To and including
netrc and redirect credential leak	6.5	8.11.0
OCSP stapling bypass with GnuTLS	7.41.0	8.9.1
ASN.1 date parser overread	7.32.0	8.9.0
HTTP/2 push headers memory-leak	7.44.0	8.6.0
cookie mixed case PSL bypass	7.46.0	8.4.0
cookie injection with none file	7.9.1	8.3.0
more POST-after-PUT confusion	7.7	8.0.1
IDN wildcard match	7.12.0	8.0.1
siglongjmp race condition	7.9.8	8.0.1
SSH connection too eager reuse still	7.16.1	7.88.1
GSS delegation too eager connection re-use	7.22.0	7.88.1
FTP too eager connection reuse	7.13.0	7.88.1
SFTP path ~ resolving discrepancy	7.18.0	7.88.1
TELNET option IAC injection	7.7	7.88.1
HTTP Proxy deny use after free	7.16.0	7.86.0
POST following PUT confusion	7.7	7.85.0
control code in cookie denial of service	4.9	7.84.0
FTP-KRB bad message verification	7.16.4	7.83.1
TLS and SSH connection too eager reuse	7.16.1	7.83.0
CERTINFO never-ending busy-loop	7.34.0	7.83.0
Auth/cookie leak on redirect	4.9	7.82.0
Credential leak on redirect	4.9	7.82.0
OAUTH2 bearer bypass in connection re-use	7.33.0	7.82.0
STARTTLS protocol injection via MITM	7.20.0	7.78.0
Protocol downgrade required TLS bypassed	7.20.0	7.78.0
CURLOPT_SSLCERT mix-up with Secure Transport	7.33.0	7.77.0
TELNET stack contents disclosure again	7.7	7.77.0
Bad connection reuse due to flawed path name checks	7.10.4	7.77.0
Metalink download sends credentials	7.27.0	7.77.0
Wrong content via Metalink not discarded	7.27.0	7.77.0
TELNET stack contents disclosure	7.7	7.76.1
Automatic referer leaks credentials	7.1.1	7.75.0
Inferior OCSP verification	7.41.0	7.73.0
FTP wildcard stack overflow	7.21.0	7.73.0
trusting FTP PASV responses	4.0	7.73.0
wrong connect-only connection	7.29.0	7.71.1
curl overwrite local file with -J	7.20.0	7.70.0
FTP-KRB double free	7.52.0	7.65.3
TFTP small blocksize heap buffer overflow	7.19.4	7.65.3
Windows OpenSSL engine code injection	7.44.0	7.65.1
TFTP receive buffer overflow	7.19.4	7.64.1
NTLM type-2 out-of-bounds buffer read	7.36.0	7.63.0
NTLMv2 type-3 header stack buffer overflow	7.36.0	7.63.0
SMTP end-of-response out-of-bounds read	7.34.0	7.63.0
warning message out-of-buffer read	7.14.1	7.61.1
SASL password overflow via integer overflow	7.33.0	7.61.1
NTLM password overflow via integer overflow	7.15.4	7.61.0
RTSP bad headers buffer over-read	7.20.0	7.59.0
RTSP RTP buffer over-read	7.20.0	7.58.0
LDAP NULL pointer dereference	7.21.0	7.58.0
FTP path trickery leads to NIL byte out of bounds write	7.12.3	7.58.0
HTTP authentication leak in redirects	6.0	7.57.0
HTTP/2 trailer out-of-bounds read	7.49.0	7.57.0
FTP wildcard out of bounds read	7.21.0	7.56.1
NTLM buffer overflow via integer overflow	7.36.0	7.56.1
IMAP FETCH response out of bounds read	7.20.0	7.56.0
FTP PWD response parser out of bounds read	7.7	7.55.1
URL globbing out of bounds read	7.34.0	7.54.1
TFTP sends more than buffer size	7.15.0	7.54.1
URL file scheme drive letter buffer overflow	7.53.0	7.54.0

Futher details

CVE data for 7.54.0 provided as JSON.

Changelog for curl 7.54.0

See vulnerability summary for the previous release: 7.53.1 or the subsequent release: 7.54.1