curl / Docs / Vulnerability table / 7.61.1 vulnerabilities

Vulnerabilities in curl 7.61.1

curl version 7.61.1 was released on September 5 2018. The following 12 security problems are known to exist in this version.

FlawFrom versionTo and includingCVECWE
wrong connect-only connection7. Expired Pointer Dereference
curl overwrite local file with -J7. Improper Restriction of Names for Files and Other Resources
FTP-KRB double-free7. Double Free
TFTP small blocksize heap buffer overflow7. Heap-based Buffer Overflow
Windows OpenSSL engine code injection7. Code Injection
TFTP receive buffer overflow7. Heap-based Buffer Overflow
NTLM type-2 out-of-bounds buffer read7. Out-of-bounds Read
NTLMv2 type-3 header stack buffer overflow7. Stack-based Buffer Overflow
SMTP end-of-response out-of-bounds read7. Out-of-bounds Read
warning message out-of-buffer read7. Out-of-bounds Read
use-after-free in handle close7. Use After Free
SASL password overflow via integer overflow7. Incorrect Calculation of Buffer Size

Changelog for curl 7.61.1

See vulnerability summary for the previous release: 7.61.0 or the subsequent release: 7.62.0