Description
Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL (tftp://) with a valid hostname and a long path.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 7.15.3-1 | — |
| Debian 13 | curl | 7.15.3-1 | — |
| Debian 12 | curl | 7.15.3-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 7.79.1-1.1 | openSUSE-SU-2024:10582-1 |
Advisories 1
- openSUSE-SU-2024:10582-1 curl-7.79.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- FEDORA-2006-189 vendor-advisory
- 19371 third-party-advisory
- GLSA-200603-19 vendor-advisory
- ADV-2006-1008 vdb-entry
- http://curl.haxx.se/docs/adv_20060320.html
- 19335 third-party-advisory
- 17154 vdb-entry
- 23982 vdb-entry
- 20060320 [SSAG#001] :: cURL tftp:// URL Buffer Overflow mailing-list
- 2006-0016 vendor-advisory
- 19271 third-party-advisory
- curl-tftp-bo(25318) vdb-entry
- 19344 third-party-advisory