Information disclosure in Apple Mac OS X
CVE-2015-3153
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.
Vulnerability class: Information Disclosure
EPSS: 0.075 (93.9th percentile) — read the EPSS interpretation.
Affected products
- Apple Mac_os_x — versions 10.10.4
- Haxx Curl
- Haxx Libcurl
- Oracle Enterprise_manager_ops_center — versions 12.2.0, 12.2.1, 12.3.0
- Canonical Ubuntu_linux — versions 12.04, 14.04, 14.10
- Debian Debian_linux — versions 8.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- secalert@redhat.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
- secalert@redhat.com (vendor-advisory, x_refsource_APPLE, Mailing List, Third Party Advisory)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2015-3153?
- CVE-2015-3153 is a vulnerability in Apple Mac OS X, classified under Information Disclosure. Published 2015-05-01.
- Is CVE-2015-3153 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.