CVEvulnerability

CVE-2015-3144

9.0 HIGH Published 2015-04-24 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2015-04-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
Weaknesses
CWE-119

Description

The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."

Affected configurations

• oracle mysql enterprise monitor (<= 2.3.20) • oracle mysql enterprise monitor (<= 3.0.22) • haxx curl 7.37.0 • haxx curl 7.37.1 • haxx curl 7.38.0 • haxx curl 7.39.0 • haxx curl 7.40.0 • haxx curl 7.41.0 • haxx libcurl 7.37.0 • haxx libcurl 7.37.1 • haxx libcurl 7.38.0 • haxx libcurl 7.39 • haxx libcurl 7.40.0 • haxx libcurl 7.41.0 • canonical ubuntu linux 12.04 • canonical ubuntu linux 14.04 • canonical ubuntu linux 14.10 • canonical ubuntu linux 15.04 • debian debian linux 7.0

Related

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References