CVE-2015-3153
Fixed in a distro release EPSS 7%
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
Products: oracle enterprise_manager_ops_center, haxx curl, haxx libcurl, canonical ubuntu_linux, apple mac_os_x, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | curl | 7.42.1-1 |
| Debian 13 | curl | 7.42.1-1 |
| Debian 14 | curl | 7.42.1-1 |
| Debian 8 | curl | 7.38.0-4+deb8u2 |
| SUSE Linux Enterprise Desktop 12 | curl | 7.37.0-15.1 |
| SUSE Linux Enterprise Server 12 | curl | 7.37.0-15.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | curl | 7.37.0-15.1 |
| SUSE Linux Enterprise Software Development Kit 12 | curl | 7.37.0-15.1 |
| Ubuntu 14.04 LTS | curl | 7.35.0-1ubuntu2.5 |
| Ubuntu Pro 14.04 LTS | curl | no fix |
| openSUSE Tumbleweed | curl | 7.51.0-1.1 |