Fluid Attacks Database

Description

cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	curl	>=0 <7.42.0-1	7.42.0-1
rpm rhel5	curl	-	-
rpm rhel6	curl	<0:7.19.7-46.el6	0:7.19.7-46.el6
debian 14	curl	>=0 <7.42.0-1	7.42.0-1
debian 12	curl	>=0 <7.42.0-1	7.42.0-1
rpm rhel7	curl	<0:7.29.0-25.el7	0:7.29.0-25.el7

Aliases

1. CVE-2015-31432. NVD-2015-31433. OSV-DEBIAN-2015-31434. OSV-2015-31435. SECURITY-TRACKER-CVE-2015-3143

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.