CVE-2015-3153 | BDVDB-2026-69267 Detail
Description#
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- https://kc.mcafee.com/corporate/index?page=content&id=SB10131
- http://www.securitytracker.com/id/1032233
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- http://www.ubuntu.com/usn/USN-2591-1
- http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
- http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
- https://support.apple.com/kb/HT205031
- http://www.securityfocus.com/bid/74408
- http://curl.haxx.se/docs/adv_20150429.html
- http://www.debian.org/security/2015/dsa-3240
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.