CVE-2019-3823 | Medium | 4.3 | 2019-02-06 | libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer pass… |
CVE-2019-3822 | Critical | 9.8 | 2019-02-06 | libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth… |
CVE-2018-16890 | High | 7.5 | 2019-02-06 | libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vaut… |
CVE-2018-16842 | Medium | 4.4 | 2018-10-31 | Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure… |
CVE-2018-16840 | Critical | 9.8 | 2018-10-31 | A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an… |
CVE-2018-16839 | Medium | 4.3 | 2018-10-31 | Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service. |
CVE-2016-8625 | Medium | 5.3 | 2018-08-01 | curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue n… |
CVE-2016-8623 | Low | 3.3 | 2018-08-01 | A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosur… |
CVE-2016-8620 | Medium | 6.5 | 2018-08-01 | The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input. |
CVE-2016-8619 | Medium | 5.3 | 2018-08-01 | The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free. |
CVE-2016-8616 | Low | 3.7 | 2018-08-01 | A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the exist… |
CVE-2016-8615 | Medium | 5.3 | 2018-08-01 | A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a mal… |
CVE-2016-8621 | Medium | 5.3 | 2018-07-31 | The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short. |
CVE-2016-8617 | Low | 3.3 | 2018-07-31 | The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `… |
CVE-2016-8624 | Medium | 5.3 | 2018-07-31 | curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be t… |
CVE-2016-8622 | Low | 3.7 | 2018-07-31 | The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a… |
CVE-2016-8618 | Medium | 5.3 | 2018-07-31 | The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on sy… |