curl / Docs / Vulnerability table / 7.61.1 vulnerabilities

Vulnerabilities in curl 7.61.1

curl version 7.61.1 was released on September 5 2018. The following 46 security problems are known to exist in this version.

Flaw	From version	To and including
cookie mixed case PSL bypass	7.46.0	8.4.0
cookie injection with none file	7.9.1	8.3.0
more POST-after-PUT confusion	7.7	8.0.1
IDN wildcard match	7.12.0	8.0.1
siglongjmp race condition	7.9.8	8.0.1
SSH connection too eager reuse still	7.16.1	7.88.1
GSS delegation too eager connection re-use	7.22.0	7.88.1
FTP too eager connection reuse	7.13.0	7.88.1
SFTP path ~ resolving discrepancy	7.18.0	7.88.1
TELNET option IAC injection	7.7	7.88.1
HTTP multi-header compression denial of service	7.57.0	7.87.0
HTTP Proxy deny use after free	7.16.0	7.86.0
POST following PUT confusion	7.7	7.85.0
control code in cookie denial of service	4.9	7.84.0
FTP-KRB bad message verification	7.16.4	7.83.1
HTTP compression denial of service	7.57.0	7.83.1
TLS and SSH connection too eager reuse	7.16.1	7.83.0
CERTINFO never-ending busy-loop	7.34.0	7.83.0
Auth/cookie leak on redirect	4.9	7.82.0
Credential leak on redirect	4.9	7.82.0
OAUTH2 bearer bypass in connection re-use	7.33.0	7.82.0
STARTTLS protocol injection via MITM	7.20.0	7.78.0
Protocol downgrade required TLS bypassed	7.20.0	7.78.0
CURLOPT_SSLCERT mix-up with Secure Transport	7.33.0	7.77.0
TELNET stack contents disclosure again	7.7	7.77.0
Bad connection reuse due to flawed path name checks	7.10.4	7.77.0
Metalink download sends credentials	7.27.0	7.77.0
Wrong content via Metalink not discarded	7.27.0	7.77.0
TELNET stack contents disclosure	7.7	7.76.1
Schannel cipher selection surprise	7.61.0	7.76.1
Automatic referer leaks credentials	7.1.1	7.75.0
Inferior OCSP verification	7.41.0	7.73.0
FTP wildcard stack overflow	7.21.0	7.73.0
trusting FTP PASV responses	4.0	7.73.0
wrong connect-only connection	7.29.0	7.71.1
curl overwrite local file with -J	7.20.0	7.70.0
FTP-KRB double free	7.52.0	7.65.3
TFTP small blocksize heap buffer overflow	7.19.4	7.65.3
Windows OpenSSL engine code injection	7.44.0	7.65.1
TFTP receive buffer overflow	7.19.4	7.64.1
NTLM type-2 out-of-bounds buffer read	7.36.0	7.63.0
NTLMv2 type-3 header stack buffer overflow	7.36.0	7.63.0
SMTP end-of-response out-of-bounds read	7.34.0	7.63.0
warning message out-of-buffer read	7.14.1	7.61.1
use after free in handle close	7.59.0	7.61.1
SASL password overflow via integer overflow	7.33.0	7.61.1

CVE data for 7.61.1 provided as JSON.

Changelog for curl 7.61.1

See vulnerability summary for the previous release: 7.61.0 or the subsequent release: 7.62.0