CVE-2015-3143
Fixed in a distro release EPSS 11%
cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.
Products: haxx curl, canonical ubuntu_linux, debian_linux, haxx libcurl, hp system_management_homepage, apple mac_os_x
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | curl | 7.42.0-1 |
| Debian 13 | curl | 7.42.0-1 |
| Debian 14 | curl | 7.42.0-1 |
| Debian 6.0 | curl | 7.21.0-2.1+squeeze12 |
| Debian 7 | curl | 7.26.0-1+wheezy13 |
| Debian 8 | curl | 7.38.0-4+deb8u1 |
| Red Hat Enterprise Linux 6 | curl | 0:7.19.7-46.el6 |
| Red Hat Enterprise Linux 6 | curl-debuginfo | 0:7.19.7-46.el6 |
| Red Hat Enterprise Linux 6 | libcurl | 0:7.19.7-46.el6 |
| Red Hat Enterprise Linux 6 | libcurl-devel | 0:7.19.7-46.el6 |
| Red Hat Enterprise Linux 7 | curl | 0:7.29.0-25.el7 |
| Red Hat Enterprise Linux 7 | curl-debuginfo | 0:7.29.0-25.el7 |
| Red Hat Enterprise Linux 7 | libcurl | 0:7.29.0-25.el7 |
| Red Hat Enterprise Linux 7 | libcurl-devel | 0:7.29.0-25.el7 |
| SUSE Linux Enterprise Desktop 12 | curl | 7.37.0-15.1 |
| SUSE Linux Enterprise Server 12 | curl | 7.37.0-15.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | curl | 7.37.0-15.1 |
| SUSE Linux Enterprise Software Development Kit 12 | curl | 7.37.0-15.1 |
| Ubuntu 14.04 LTS | curl | 7.35.0-1ubuntu2.5 |
| openSUSE Tumbleweed | curl | 7.51.0-1.1 |