CVE-2014-0015
Fixed in a distro release EPSS 6%
cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.
Products: haxx libcurl, haxx curl
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | curl | 7.35.0-1 |
| Debian 13 | curl | 7.35.0-1 |
| Debian 14 | curl | 7.35.0-1 |
| Debian 6.0 | curl | 7.21.0-2.1+squeeze7 |
| Debian 7 | curl | 7.26.0-1+wheezy8 |
| Red Hat Enterprise Linux 6 | curl | 0:7.19.7-37.el6_5.3 |
| Red Hat Enterprise Linux 6 | curl-debuginfo | 0:7.19.7-37.el6_5.3 |
| Red Hat Enterprise Linux 6 | libcurl | 0:7.19.7-37.el6_5.3 |
| Red Hat Enterprise Linux 6 | libcurl-devel | 0:7.19.7-37.el6_5.3 |
| openSUSE Tumbleweed | curl | 7.51.0-1.1 |