Skip to content
OpenAdvisories
Unscored RHSA-2015:1254 5 CVEs

Red Hat Security Advisory: curl security, bug fix, and enhancement update

Published Sep 15, 2024 · Updated Jun 28, 2026

Ecosystem: Red Hat

Fixed packages 16

ReleasePackageFixed in
Red Hat · RHEL 6 enterprise_linux:6::client curl 0:7.19.7-46.el6
Red Hat · RHEL 6 enterprise_linux:6::client curl-debuginfo 0:7.19.7-46.el6
Red Hat · RHEL 6 enterprise_linux:6::client libcurl 0:7.19.7-46.el6
Red Hat · RHEL 6 enterprise_linux:6::client libcurl-devel 0:7.19.7-46.el6
Red Hat · RHEL 6 enterprise_linux:6::computenode curl 0:7.19.7-46.el6
Red Hat · RHEL 6 enterprise_linux:6::computenode curl-debuginfo 0:7.19.7-46.el6
Red Hat · RHEL 6 enterprise_linux:6::computenode libcurl 0:7.19.7-46.el6
Red Hat · RHEL 6 enterprise_linux:6::computenode libcurl-devel 0:7.19.7-46.el6
Red Hat · RHEL 6 enterprise_linux:6::server curl 0:7.19.7-46.el6
Red Hat · RHEL 6 enterprise_linux:6::server curl-debuginfo 0:7.19.7-46.el6
Red Hat · RHEL 6 enterprise_linux:6::server libcurl 0:7.19.7-46.el6
Red Hat · RHEL 6 enterprise_linux:6::server libcurl-devel 0:7.19.7-46.el6
Red Hat · RHEL 6 enterprise_linux:6::workstation curl 0:7.19.7-46.el6
Red Hat · RHEL 6 enterprise_linux:6::workstation curl-debuginfo 0:7.19.7-46.el6
Red Hat · RHEL 6 enterprise_linux:6::workstation libcurl 0:7.19.7-46.el6
Red Hat · RHEL 6 enterprise_linux:6::workstation libcurl-devel 0:7.19.7-46.el6

Vulnerabilities 5

  • Unscored —
    CVE-2014-3613

    cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attack…

    curl curl Debian Ubuntu
  • Unscored —
    CVE-2014-3707

    The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option,…

    curl curl Debian Ubuntu
  • Unscored —
    CVE-2014-8150

    CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attacker…

    curl curl Debian Ubuntu
  • Unscored —
    CVE-2015-3143 EPSS 11%

    cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to conn…

    curl curl Debian Ubuntu
  • Unscored —
    CVE-2015-3148 EPSS 14%

    cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote …

    curl curl Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=835898
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=883002
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=997185
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1008178
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1011083
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1011101
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1058767
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1104160
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1136154
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1154059
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1154747
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1154941
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1156422
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1161163
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1168137
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1178692
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1213306
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1213351
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1254.json
  • report
    https://access.redhat.com/security/cve/CVE-2014-3613
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-3613
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-3613
  • article
    http://curl.haxx.se/docs/adv_20140910A.html
  • report
    https://access.redhat.com/security/cve/CVE-2014-3707
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-3707
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-3707
  • article
    http://curl.haxx.se/docs/adv_20141105.html
  • report
    https://access.redhat.com/security/cve/CVE-2014-8150
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-8150
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-8150
  • article
    http://curl.haxx.se/docs/adv_20150108B.html
  • report
    https://access.redhat.com/security/cve/CVE-2015-3143
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-3143
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-3143
  • article
    http://curl.haxx.se/docs/adv_20150422A.html
  • report
    https://access.redhat.com/security/cve/CVE-2015-3148
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-3148
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-3148