CVE-2015-3144

Publication date 22 April 2015

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."

Read the notes from the security team

Status

Package Ubuntu Release Status
curl 15.04 vivid
Fixed 7.38.0-3ubuntu2.2
14.10 utopic
Fixed 7.37.1-1ubuntu3.4
14.04 LTS trusty
Not affected
12.04 LTS precise
Not affected
10.04 LTS lucid
Not affected

Notes

mdeslaur

7.37.0+

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
curl

References

Related Ubuntu Security Notices (USN)

Other references