VulnerabilityModified
CVE-2015-3153
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
MEDIUM 5.0EPSS 7.25%
Does this matter?
Lower severity and a low EPSS score (7.25%). Track it; it rarely justifies an emergency change on its own.
Description
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 7.25% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- oracle/enterprise manager ops center · haxx/curl · haxx/libcurl · canonical/ubuntu linux · apple/mac os x · debian/debian linux
- Source
- secalert@redhat.com
References
- http://curl.haxx.se/docs/adv_20150429.htmlVendor Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html
- http://www.debian.org/security/2015/dsa-3240Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlPatch, Third Party Advisory
- http://www.securityfocus.com/bid/74408
- http://www.securitytracker.com/id/1032233Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2591-1Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10131
- https://support.apple.com/kb/HT205031Third Party Advisory
- http://curl.haxx.se/docs/adv_20150429.htmlVendor Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html
- http://www.debian.org/security/2015/dsa-3240Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlPatch, Third Party Advisory
- http://www.securityfocus.com/bid/74408
- http://www.securitytracker.com/id/1032233Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2591-1Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10131
- https://support.apple.com/kb/HT205031Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.