curl / Docs / Vulnerability table / 7.56.0 vulnerabilities

Vulnerabilities in curl 7.56.0

curl version 7.56.0 was released on October 4 2017. The following 33 security problems are known to exist in this version.

FlawFrom versionTo and includingCVECWE
CURLOPT_SSLCERT mixup with Secure Transport7.33.07.77.0CVE-2021-22926CWE-295: Improper Certificate Validation
TELNET stack contents disclosure again7.77.77.0CVE-2021-22925CWE-457: Use of Uninitialized Variable
Bad connection reuse due to flawed path name checks7.10.47.77.0CVE-2021-22924CWE-295: Improper Certificate Validation
Metalink download sends credentials7.27.07.77.0CVE-2021-22923CWE-522: Insufficiently Protected Credentials
Wrong content via metalink not discarded7.27.07.77.0CVE-2021-22922CWE-20: Improper Input Validation
TELNET stack contents disclosure7.77.76.1CVE-2021-22898CWE-457: Use of Uninitialized Variable
Automatic referer leaks credentials7.1.17.75.0CVE-2021-22876CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Inferior OCSP verification7.41.07.73.0CVE-2020-8286CWE-299: Improper Check for Certificate Revocation
FTP wildcard stack overflow7.21.07.73.0CVE-2020-8285CWE-674: Uncontrolled Recursion
trusting FTP PASV responses4.07.73.0CVE-2020-8284CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
wrong connect-only connection7.29.07.71.1CVE-2020-8231CWE-825: Expired Pointer Dereference
curl overwrite local file with -J7.20.07.70.0CVE-2020-8177CWE-641: Improper Restriction of Names for Files and Other Resources
FTP-KRB double-free7.52.07.65.3CVE-2019-5481CWE-415: Double Free
TFTP small blocksize heap buffer overflow7.19.47.65.3CVE-2019-5482CWE-122: Heap-based Buffer Overflow
TFTP receive buffer overflow7.19.47.64.1CVE-2019-5436CWE-122: Heap-based Buffer Overflow
NTLM type-2 out-of-bounds buffer read7.36.07.63.0CVE-2018-16890CWE-125: Out-of-bounds Read
NTLMv2 type-3 header stack buffer overflow7.36.07.63.0CVE-2019-3822CWE-121: Stack-based Buffer Overflow
SMTP end-of-response out-of-bounds read7.34.07.63.0CVE-2019-3823CWE-125: Out-of-bounds Read
warning message out-of-buffer read7.14.17.61.1CVE-2018-16842CWE-125: Out-of-bounds Read
SASL password overflow via integer overflow7.33.07.61.1CVE-2018-16839CWE-131: Incorrect Calculation of Buffer Size
NTLM password overflow via integer overflow7.15.47.61.0CVE-2018-14618CWE-131: Incorrect Calculation of Buffer Size
SMTP send heap buffer overflow7.54.17.60.0CVE-2018-0500CWE-122: Heap-based Buffer Overflow
FTP shutdown response buffer overflow7.54.17.59.0CVE-2018-1000300CWE-122: Heap-based Buffer Overflow
RTSP bad headers buffer over-read7.20.07.59.0CVE-2018-1000301CWE-126: Buffer Over-read
RTSP RTP buffer over-read7.20.07.58.0CVE-2018-1000122CWE-126: Buffer Over-read
LDAP NULL pointer dereference7.21.07.58.0CVE-2018-1000121CWE-476: NULL Pointer Dereference
FTP path trickery leads to NIL byte out of bounds write7.12.37.58.0CVE-2018-1000120CWE-122: Heap-based Buffer Overflow
HTTP authentication leak in redirects6.07.57.0CVE-2018-1000007CWE-522: Insufficiently Protected Credentials
HTTP/2 trailer out-of-bounds read7.49.07.57.0CVE-2018-1000005CWE-126: Buffer Over-read
SSL out of buffer access7.56.07.56.1CVE-2017-8818CWE-125: Out-of-bounds Read
FTP wildcard out of bounds read7.21.07.56.1CVE-2017-8817CWE-126: Buffer Over-read
NTLM buffer overflow via integer overflow7.36.07.56.1CVE-2017-8816CWE-131: Incorrect Calculation of Buffer Size
IMAP FETCH response out of bounds read7.20.07.56.0CVE-2017-1000257CWE-126: Buffer Over-read

Changelog for curl 7.56.0

See vulnerability summary for the previous release: 7.55.1 or the subsequent release: 7.56.1