CVE-2015-3144

Loading...

General

Score:9.0/10.0
Severity:High
Category:Buffer Error
Exploit:Available

Impact Metrics

Confidentiality:Complete
Integrity:Complete
Availability:Complete

Exploitability Metrics

Access Vector:Network
Access Complexity:Low
Authentication:Single

Relative vulnerabilities

CVE-2009-5044, CVE-2009-5078, CVE-2013-1775, CVE-2013-1776, CVE-2013-2776, CVE-2013-2777, CVE-2013-7040, CVE-2013-7338, CVE-2013-7422, CVE-2014-0015, CVE-2014-0067, CVE-2014-0106, CVE-2014-0191, CVE-2014-1912, CVE-2014-3581, CVE-2014-3583, CVE-2014-3613, CVE-2014-3620, CVE-2014-3660, CVE-2014-3707, CVE-2014-7185, CVE-2014-7844, CVE-2014-8109, CVE-2014-8150, CVE-2014-8151, CVE-2014-8161, CVE-2014-8767, CVE-2014-8769, CVE-2014-9140, CVE-2014-9365, CVE-2014-9680, CVE-2015-0228, CVE-2015-0241, CVE-2015-0242, CVE-2015-0243, CVE-2015-0244, CVE-2015-0253, CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792, CVE-2015-2783, CVE-2015-2787, CVE-2015-3143, CVE-2015-3145, CVE-2015-3148, CVE-2015-3153, CVE-2015-3183, CVE-2015-3185, CVE-2015-3307, CVE-2015-3329, CVE-2015-3330, CVE-2015-3757, CVE-2015-3760, CVE-2015-3761, CVE-2015-3762, CVE-2015-3764, CVE-2015-3765, CVE-2015-3766, CVE-2015-3767, CVE-2015-3768, CVE-2015-3769, CVE-2015-3770, CVE-2015-3771, CVE-2015-3772, CVE-2015-3773, CVE-2015-3774, CVE-2015-3775, CVE-2015-3776, CVE-2015-3777, CVE-2015-3778, CVE-2015-3779, CVE-2015-3780, CVE-2015-3781, CVE-2015-3782, CVE-2015-3783, CVE-2015-3784, CVE-2015-3786, CVE-2015-3787, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-3794, CVE-2015-3795, CVE-2015-3796, CVE-2015-3797, CVE-2015-3798, CVE-2015-3799, CVE-2015-3800, CVE-2015-3802, CVE-2015-3803, CVE-2015-3804, CVE-2015-3805, CVE-2015-3806, CVE-2015-3807, CVE-2015-4021, CVE-2015-4022, CVE-2015-4024, CVE-2015-4025, CVE-2015-4026, CVE-2015-4147, CVE-2015-4148, CVE-2015-5600, CVE-2015-5747, CVE-2015-5748, CVE-2015-5750, CVE-2015-5751, CVE-2015-5753, CVE-2015-5754, CVE-2015-5755, CVE-2015-5756, CVE-2015-5757, CVE-2015-5758, CVE-2015-5761, CVE-2015-5763, CVE-2015-5768, CVE-2015-5771, CVE-2015-5772, CVE-2015-5773, CVE-2015-5774, CVE-2015-5775, CVE-2015-5776, CVE-2015-5777, CVE-2015-5778, CVE-2015-5779, CVE-2015-5781, CVE-2015-5782, CVE-2015-5783, CVE-2015-5784

Published on 24/04/15 - Updated on 17/10/18

Description

The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."

Category: Buffer Error

CWE-119 (Buffer Errors)
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Security Notices

US National Vulnerability DatabaseCVE-2015-3144
Amazon Linux ALAS-2015-514
Agence Nationale de la Sécurité des Systèmes d'Information CERTFR-2015-AVI-355, CERTFR-2015-AVI-438, CERTFR-2016-AVI-128
Apple HT205031
Arch Linux ASA-201504-28
SUSE SUSE-SU-2015:0990
Ubuntu USN-2591-1

Exploits

SecurityFocusBID-74300

Relative technologies

VendorProduct
canonicalubuntu_linux
debiandebian_linux
haxxcurl
haxxlibcurl
oraclemysql_enterprise_monitor

Share this vulnerability with:

Twitter Facebook LinkedIn Mail