curl / Docs / Vulnerability table / 7.58.0 vulnerabilities

Vulnerabilities in curl 7.58.0

curl version 7.58.0 was released on January 24 2018

It has the following 54 published security problems.

FlawFrom versionTo and including
OCSP stapling bypass with GnuTLS7.41.08.9.1
ASN.1 date parser overread7.32.08.9.0
HTTP/2 push headers memory-leak7.44.08.6.0
cookie mixed case PSL bypass7.46.08.4.0
cookie injection with none file7.9.18.3.0
more POST-after-PUT confusion7.78.0.1
IDN wildcard match7.12.08.0.1
siglongjmp race condition7.9.88.0.1
SSH connection too eager reuse still7.16.17.88.1
GSS delegation too eager connection re-use7.22.07.88.1
FTP too eager connection reuse7.13.07.88.1
SFTP path ~ resolving discrepancy7.18.07.88.1
TELNET option IAC injection7.77.88.1
HTTP multi-header compression denial of service7.57.07.87.0
HTTP Proxy deny use after free7.16.07.86.0
POST following PUT confusion7.77.85.0
control code in cookie denial of service4.97.84.0
FTP-KRB bad message verification7.16.47.83.1
HTTP compression denial of service7.57.07.83.1
TLS and SSH connection too eager reuse7.16.17.83.0
CERTINFO never-ending busy-loop7.34.07.83.0
Auth/cookie leak on redirect4.97.82.0
Credential leak on redirect4.97.82.0
OAUTH2 bearer bypass in connection re-use7.33.07.82.0
STARTTLS protocol injection via MITM7.20.07.78.0
Protocol downgrade required TLS bypassed7.20.07.78.0
CURLOPT_SSLCERT mix-up with Secure Transport7.33.07.77.0
TELNET stack contents disclosure again7.77.77.0
Bad connection reuse due to flawed path name checks7.10.47.77.0
Metalink download sends credentials7.27.07.77.0
Wrong content via Metalink not discarded7.27.07.77.0
TELNET stack contents disclosure7.77.76.1
Automatic referer leaks credentials7.1.17.75.0
Inferior OCSP verification7.41.07.73.0
FTP wildcard stack overflow7.21.07.73.0
trusting FTP PASV responses4.07.73.0
wrong connect-only connection7.29.07.71.1
curl overwrite local file with -J7.20.07.70.0
FTP-KRB double free7.52.07.65.3
TFTP small blocksize heap buffer overflow7.19.47.65.3
Windows OpenSSL engine code injection7.44.07.65.1
TFTP receive buffer overflow7.19.47.64.1
NTLM type-2 out-of-bounds buffer read7.36.07.63.0
NTLMv2 type-3 header stack buffer overflow7.36.07.63.0
SMTP end-of-response out-of-bounds read7.34.07.63.0
warning message out-of-buffer read7.14.17.61.1
SASL password overflow via integer overflow7.33.07.61.1
NTLM password overflow via integer overflow7.15.47.61.0
SMTP send heap buffer overflow7.54.17.60.0
FTP shutdown response buffer overflow7.54.17.59.0
RTSP bad headers buffer over-read7.20.07.59.0
RTSP RTP buffer over-read7.20.07.58.0
LDAP NULL pointer dereference7.21.07.58.0
FTP path trickery leads to NIL byte out of bounds write7.12.37.58.0

Futher details

CVE data for 7.58.0 provided as JSON.

Changelog for curl 7.58.0

See vulnerability summary for the previous release: 7.57.0 or the subsequent release: 7.59.0