KLA10618 Information disclosure vulnerability in cURL

Multiple serious vulnerabilities have been found in cURL. Malicious users can exploit these vulnerabilities to obtain sensitive information.

Below is a complete list of vulnerabilities

1. An unknown vulnerability related to SMB can be exploited remotely via specially designed length and offset values;
2. Improper credentials handling can be exploited remotely via vectors related to curl_easy_reset connection.

Original advisories

cURL advisory

cURL advisory

Related products

cURL

CVE list

CVE-2015-3236 critical

CVE-2015-3237 high

Solution

Update to the latest version

Get cURL

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

Affected Products

• cURL and libcurl versions from 7.40.0 through 7.42.1