CVEvulnerability
CVE-2015-3153
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-05-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
Affected configurations
• oracle enterprise manager ops center (<= 12.1.3)
• oracle enterprise manager ops center 12.2.0
• oracle enterprise manager ops center 12.2.1
• oracle enterprise manager ops center 12.3.0
• haxx curl (<= 7.42.0)
• haxx libcurl (<= 7.42.0)
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 14.10
• canonical ubuntu linux 15.1
• apple mac os x 10.10.4
• debian debian linux 8.0
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://curl.haxx.se/docs/adv_20150429.html Vendor Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743 kb.juniper.net
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html lists.opensuse.org
- http://www.debian.org/security/2015/dsa-3240 Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html www.oracle.com
- http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html www.oracle.com
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html Patch, Third Party Advisory
- http://www.securityfocus.com/bid/74408 www.securityfocus.com
- http://www.securitytracker.com/id/1032233 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2591-1 Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10131 kc.mcafee.com
- https://support.apple.com/kb/HT205031 Third Party Advisory
- http://curl.haxx.se/docs/adv_20150429.html Vendor Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743 kb.juniper.net
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html lists.opensuse.org
- http://www.debian.org/security/2015/dsa-3240 Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html www.oracle.com
- http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html www.oracle.com
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html Patch, Third Party Advisory
- http://www.securityfocus.com/bid/74408 www.securityfocus.com
- http://www.securitytracker.com/id/1032233 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2591-1 Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10131 kc.mcafee.com
- https://support.apple.com/kb/HT205031 Third Party Advisory