CVE-2015-3236
Gentoo Linux Security Advisory 201509-02
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.
cURL y libcurl 7.40.0 hasta la versión 7.42.1 mandan las credenciales de autenticación HTTP Basic de una conexión previa cuando se reutiliza en una conexión de reinicio (curl_easy_reset) usada para enviar una petición al mismo nombre de anfitrión, lo que permite a atacantes remotos obtener información sensible a través de vectores no especificados.
Multiple vulnerabilities have been found in cURL, the worst of which can allow remote attackers to cause Denial of Service condition. Versions less than 7.43.0 are affected.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-04-10 CVE Reserved
- 2015-06-22 CVE Published
- 2024-08-06 CVE Updated
- 2025-05-18 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html | X_refsource_confirm |
|
| http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html | X_refsource_confirm |
|
| http://www.securityfocus.com/bid/75385 | Vdb Entry | |
| http://www.securityfocus.com/bid/91787 | Third Party Advisory | |
| https://kc.mcafee.com/corporate/index?page=content&id=SB10131 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html | 2018-10-17 | |
| http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html | 2018-10-17 |
| URL | Date | SRC |
|---|---|---|
| http://curl.haxx.se/docs/adv_20150617A.html | 2018-10-17 | |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160660.html | 2018-10-17 | |
| https://security.gentoo.org/glsa/201509-02 | 2018-10-17 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Haxx Search vendor "Haxx" | Curl Search vendor "Haxx" for product "Curl" | 7.40.0 Search vendor "Haxx" for product "Curl" and version "7.40.0" | - |
Affected
| ||||||
| Haxx Search vendor "Haxx" | Curl Search vendor "Haxx" for product "Curl" | 7.41.0 Search vendor "Haxx" for product "Curl" and version "7.41.0" | - |
Affected
| ||||||
| Haxx Search vendor "Haxx" | Curl Search vendor "Haxx" for product "Curl" | 7.42.0 Search vendor "Haxx" for product "Curl" and version "7.42.0" | - |
Affected
| ||||||
| Haxx Search vendor "Haxx" | Curl Search vendor "Haxx" for product "Curl" | 7.42.1 Search vendor "Haxx" for product "Curl" and version "7.42.1" | - |
Affected
| ||||||
| Haxx Search vendor "Haxx" | Libcurl Search vendor "Haxx" for product "Libcurl" | 7.40.0 Search vendor "Haxx" for product "Libcurl" and version "7.40.0" | - |
Affected
| ||||||
| Haxx Search vendor "Haxx" | Libcurl Search vendor "Haxx" for product "Libcurl" | 7.41.0 Search vendor "Haxx" for product "Libcurl" and version "7.41.0" | - |
Affected
| ||||||
| Haxx Search vendor "Haxx" | Libcurl Search vendor "Haxx" for product "Libcurl" | 7.42.0 Search vendor "Haxx" for product "Libcurl" and version "7.42.0" | - |
Affected
| ||||||
| Haxx Search vendor "Haxx" | Libcurl Search vendor "Haxx" for product "Libcurl" | 7.42.1 Search vendor "Haxx" for product "Libcurl" and version "7.42.1" | - |
Affected
| ||||||