CVE-2015-3153

Published: May 1, 2015Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.

Affected (12)

Products: Oracle: Enterprise Manager Ops Center · Haxx: Curl, Libcurl · Canonical: Ubuntu Linux · +2 more

Show all products

Oracle: Enterprise Manager Ops Center · Haxx: Curl, Libcurl · Canonical: Ubuntu Linux · Apple: Mac Os X · Debian: Debian Linux

1 product

Enterprise Manager Ops Center

2 products

1 product

1 product

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Oracle Enterprise Manager Ops Center	Up to 12.1.3
Oracle Enterprise Manager Ops Center	Version 12.2.0
Oracle Enterprise Manager Ops Center	Version 12.2.1
Oracle Enterprise Manager Ops Center	Version 12.3.0

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Haxx Curl	Up to 7.42.0
Haxx Libcurl	Up to 7.42.0

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 14.10
Canonical Ubuntu Linux	Version 15.1

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	Version 10.10.4

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (28)

http://curl.haxx.se/docs/adv_20150429.html

Source: secalert@redhat.com

Vendor Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html

Source: secalert@redhat.com

http://www.debian.org/security/2015/dsa-3240

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.securityfocus.com/bid/74408

Source: secalert@redhat.com

http://www.securitytracker.com/id/1032233

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2591-1

Source: secalert@redhat.com

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10131

Source: secalert@redhat.com

https://support.apple.com/kb/HT205031

Source: secalert@redhat.com

Third Party Advisory

http://curl.haxx.se/docs/adv_20150429.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2015/dsa-3240

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

http://www.securityfocus.com/bid/74408

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1032233

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2591-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10131

Source: af854a3a-2127-422b-91ae-364da2661108

https://support.apple.com/kb/HT205031

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.