4/26/2020 Vulnerabilities in curl 7.19.

Docs Overview
curl / Docs / Vulnerability table / 7.19.3 vulnerabilities

Vulnerabilities in curl 7.19.3

curl version 7.19.3 was released on January 19 Related:
2009. The following 39 security problems are known
to exist in this version. Bug Bounty
Changelog
Donate
FAQ
Security Problems
Security Process
Vulnerabilities Table
From To and
Flaw CVE CWE
version including
CVE-
warning message out- CWE-125: Out-of-bounds
7.14.1 7.61.1 2018-
of-buffer read Read
16842
NTLM password CVE-
CWE-131: Incorrect
overflow via integer 7.15.4 7.61.0 2018-
Calculation of Buffer Size
overflow 14618
FTP path trickery CVE-
CWE-122: Heap-based
leads to NIL byte out 7.12.3 7.58.0 2018-
Buffer Overflow
of bounds write 1000120
CVE-
HTTP authentication CWE-522: Insufficiently
6.0 7.57.0 2018-
leak in redirects Protected Credentials
1000007
FTP PWD response CVE-
CWE-126: Buffer Over-
parser out of bounds 7.7 7.55.1 2017-
read
read 1000254
CVE-
TFTP sends more CWE-126: Buffer Over-
7.15.0 7.54.1 2017-
than buffer size read
1000100
--write-out out of buffer 6.5 7.53.1 CVE- CWE-126: Buffer Over-
read 2017- read
https://curl.haxx.se/docs/vuln-7.19.3.html 1/4
4/26/2020 Vulnerabilities in curl 7.19.3

7407
CVE-
printf floating point CWE-121: Stack-based
7.1 7.51.0 2016-
buffer overflow Buffer Overflow
9586
CVE-
cookie injection for CWE-187: Partial
7.1 7.50.3 2016-
other servers Comparison
8615
CVE- CWE-178: Improper
case insensitive
7.7 7.50.3 2016- Handling of Case
password comparison
8616 Sensitivity
OOB write via CVE-
CWE-131: Incorrect
unchecked 7.1 7.50.3 2016-
Calculation of Buffer Size
multiplication 8617
CVE-
double-free in
7.1 7.50.3 2016- CWE-415: Double Free
curl_maprintf
8618
CVE-
double-free in krb5
7.3 7.50.3 2016- CWE-415: Double Free
code
8619
CVE-
curl_getdate read out CWE-126: Buffer Over-
7.12.2 7.50.3 2016-
of bounds read
8621
CVE-
Use-after-free via
7.10.7 7.50.3 2016- CWE-416: Use After Free
shared cookies
8623
CVE-
invalid URL parsing
7.1 7.50.3 2016- CWE-172: Encoding Error
with '#'
8624
CVE- CWE-838: Inappropriate
IDNA 2003 makes curl
7.12.0 7.50.3 2016- Encoding for Output
use wrong host
8625 Context
curl escape and CVE-
CWE-131: Incorrect
unescape integer 7.11.1 7.50.2 2016-
Calculation of Buffer Size
overflows 7167
TLS session CVE- CWE-305: Authentication
resumption client cert 7.1 7.50.0 2016- Bypass by Primary
bypass 5419 Weakness
CVE- CWE-305: Authentication
Re-using connections
7.1 7.50.0 2016- Bypass by Primary
with wrong client cert
5420 Weakness
https://curl.haxx.se/docs/vuln-7.19.3.html 2/4
4/26/2020 Vulnerabilities in curl 7.19.3

Windows DLL 7.11.1 7.49.0 CVE- CWE-94: Improper Control

hijacking 2016- of Generation of Code
4802 ('Code Injection')
NTLM credentials not- CVE- CWE-305: Authentication
checked for proxy 7.10.7 7.46.0 2016- Bypass by Primary
connection re-use 0755 Weakness
sensitive HTTP server CVE- CWE-201: Information
headers also sent to 7.1 7.42.0 2015- Exposure Through Sent
proxies 3153 Data
CVE- CWE-305: Authentication
Negotiate not treated
7.10.6 7.41.0 2015- Bypass by Primary
as connection-oriented
3148 Weakness
Re-using
CVE- CWE-305: Authentication
authenticated
7.10.6 7.41.0 2015- Bypass by Primary
connection when
3143 Weakness
unauthenticated
CWE-444: Inconsistent
CVE-
Interpretation of HTTP
URL request injection 6.0 7.39.0 2014-
Requests ('HTTP Request
8150
Smuggling')
CVE-
duphandle read out of CWE-126: Buffer Over-
7.17.1 7.38.0 2014-
bounds read
3707
CVE- CWE-201: Information
cookie leak with IP
7.1 7.37.1 2014- Exposure Through Sent
address as domain
3613 Data
CVE- CWE-297: Improper
IP address wildcard
7.1 7.35.0 2014- Validation of Certificate
certificate validation
0139 with Host Mismatch
CVE- CWE-305: Authentication
wrong re-use of
7.10.7 7.35.0 2014- Bypass by Primary
connections
0138 Weakness
CVE- CWE-305: Authentication
re-use of wrong HTTP
7.10.6 7.34.0 2014- Bypass by Primary
NTLM connection
0015 Weakness
CVE- CWE-297: Improper
cert name check
7.18.0 7.32.0 2013- Validation of Certificate
ignore OpenSSL
4545 with Host Mismatch
URL decode buffer 7.7 7.30.0 CVE- CWE-126: Buffer Over-
boundary flaw 2013- read
https://curl.haxx.se/docs/vuln-7.19.3.html 3/4
4/26/2020 Vulnerabilities in curl 7.19.3

2174
CVE- CWE-201: Information
cookie domain
6.0 7.29.0 2013- Exposure Through Sent
tailmatch
1944 Data
CVE- CWE-924: Improper
SSL CBC IV
7.10.6 7.23.1 2011- Enforcement of Message
vulnerability
3389 Integrity
CVE- CWE-281: Improper
inappropriate GSSAPI
7.10.6 7.21.6 2011- Preservation of
delegation
2192 Permissions
CVE- CWE-628: Function Call
data callback
7.10.5 7.19.7 2010- with Incorrectly Specified
excessive length
0734 Arguments
CVE-
embedded zero in cert CWE-170: Improper Null
7.4 7.19.5 2009-
name Termination
2417
CVE- CWE-142: Improper
Arbitrary File Access 6.0 7.19.3 2009- Neutralization of Value
0037 Delimiters

Changelog for curl 7.19.3

See vulnerability summary for the previous release: 7.19.2 or the subsequent
release: 7.19.4

https://curl.haxx.se/docs/vuln-7.19.3.html 4/4