CVE-2015-3144

Published: Apr 24, 2015Modified: May 6, 2026

9.0

Vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability: 8.0 / Impact: 10.0

Source: NVD

Description

The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."

Affected (19)

Products: Oracle: Mysql Enterprise Monitor · Haxx: Curl, Libcurl · Canonical: Ubuntu Linux · +1 more

Show all products

Oracle: Mysql Enterprise Monitor · Haxx: Curl, Libcurl · Canonical: Ubuntu Linux · Debian: Debian Linux

1 product

Mysql Enterprise Monitor

2 products

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Oracle Mysql Enterprise Monitor	Up to 2.3.20
Oracle Mysql Enterprise Monitor	Up to 3.0.22

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Haxx Curl	Version 7.37.0
Haxx Curl	Version 7.37.1
Haxx Curl	Version 7.38.0
Haxx Curl	Version 7.39.0
Haxx Curl	Version 7.40.0
Haxx Curl	Version 7.41.0

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Haxx Libcurl	Version 7.37.0
Haxx Libcurl	Version 7.37.1
Haxx Libcurl	Version 7.38.0
Haxx Libcurl	Version 7.39
Haxx Libcurl	Version 7.40.0
Haxx Libcurl	Version 7.41.0

Configuration D

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 14.10
Canonical Ubuntu Linux	Version 15.04
Debian Debian Linux	Version 7.0

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (34)

http://curl.haxx.se/docs/adv_20150422D.html

Source: secalert@redhat.com

Vendor Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html

Source: secalert@redhat.com

http://www.debian.org/security/2015/dsa-3232

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/74300

Source: secalert@redhat.com

http://www.securitytracker.com/id/1032232

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2591-1

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201509-02

Source: secalert@redhat.com

https://support.apple.com/kb/HT205031

Source: secalert@redhat.com

http://curl.haxx.se/docs/adv_20150422D.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2015/dsa-3232

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/74300

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1032232

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2591-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/201509-02

Source: af854a3a-2127-422b-91ae-364da2661108

https://support.apple.com/kb/HT205031

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.