CVE-2015-3144

The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:haxx:curl:7.37.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.37.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.38.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.39.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.40.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:curl:7.41.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:haxx:libcurl:7.37.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.37.1:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.38.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.39:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.40.0:*:*:*:*:*:*:*
cpe:2.3:a:haxx:libcurl:7.41.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2015-04-24 14:59

Updated : 2024-02-04 18:35


NVD link : CVE-2015-3144

Mitre link : CVE-2015-3144

CVE.ORG link : CVE-2015-3144


JSON object : View

Products Affected

debian

  • debian_linux

oracle

  • mysql_enterprise_monitor

canonical

  • ubuntu_linux

haxx

  • curl
  • libcurl
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer