Your submission was sent successfully! Close

CVE-2016-8624

Published: 02 November 2016

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.

Priority

Medium

CVSS 3 base score: 7.5

Status

Package Release Status
curl
Launchpad, Ubuntu, Debian
Upstream
Released (7.51.0)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (7.47.0-1ubuntu2.2)
Ubuntu 14.04 ESM (Trusty Tahr)
Released (7.35.0-1ubuntu2.10)