Fluid Attacks Database

Description

The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	curl	>=0 <7.50.1-1	7.50.1-1
debian 12	curl	>=0 <7.50.1-1	7.50.1-1
debian 14	curl	>=0 <7.50.1-1	7.50.1-1

Aliases

1. CVE-2016-37392. NVD-2016-37393. OSV-DEBIAN-2016-37394. OSV-2016-37395. SECURITY-TRACKER-CVE-2016-3739

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.