UBUNTU-CVE-2016-8624

See a problem?

Source

https://ubuntu.com/security/notices/UBUNTU-CVE-2016-8624

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-8624.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2016-8624

Related

Published

2016-11-02T00:00:00Z

Modified

2016-11-02T00:00:00Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.

References

Affected packages

Ubuntu:14.04:LTS / curl

Package

Name: curl
Purl: pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.10?arch=src?distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.35.0-1ubuntu2.10

Affected versions

7.*

7.32.0-1ubuntu1

7.33.0-1ubuntu1

7.34.0-1ubuntu1

7.35.0-1ubuntu1

7.35.0-1ubuntu2

7.35.0-1ubuntu2.1

7.35.0-1ubuntu2.2

7.35.0-1ubuntu2.3

7.35.0-1ubuntu2.5

7.35.0-1ubuntu2.6

7.35.0-1ubuntu2.7

7.35.0-1ubuntu2.8

7.35.0-1ubuntu2.9

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "curl-udeb": "7.35.0-1ubuntu2.10",
            "libcurl3": "7.35.0-1ubuntu2.10",
            "libcurl4-gnutls-dev": "7.35.0-1ubuntu2.10",
            "libcurl3-dbgsym": "7.35.0-1ubuntu2.10",
            "libcurl3-nss": "7.35.0-1ubuntu2.10",
            "libcurl4-doc": "7.35.0-1ubuntu2.10",
            "libcurl3-udeb-dbgsym": "7.35.0-1ubuntu2.10",
            "libcurl3-gnutls-dbgsym": "7.35.0-1ubuntu2.10",
            "libcurl4-openssl-dev": "7.35.0-1ubuntu2.10",
            "libcurl4-openssl-dev-dbgsym": "7.35.0-1ubuntu2.10",
            "curl-dbgsym": "7.35.0-1ubuntu2.10",
            "curl": "7.35.0-1ubuntu2.10",
            "libcurl3-udeb": "7.35.0-1ubuntu2.10",
            "curl-udeb-dbgsym": "7.35.0-1ubuntu2.10",
            "libcurl4-nss-dev-dbgsym": "7.35.0-1ubuntu2.10",
            "libcurl3-gnutls": "7.35.0-1ubuntu2.10",
            "libcurl4-gnutls-dev-dbgsym": "7.35.0-1ubuntu2.10",
            "libcurl3-nss-dbgsym": "7.35.0-1ubuntu2.10",
            "libcurl3-dbg": "7.35.0-1ubuntu2.10",
            "libcurl4-nss-dev": "7.35.0-1ubuntu2.10"
        }
    ]
}

Ubuntu:16.04:LTS / curl

Package

Name: curl
Purl: pkg:deb/ubuntu/curl@7.47.0-1ubuntu2.2?arch=src?distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.47.0-1ubuntu2.2

Affected versions

7.*

7.43.0-1ubuntu2

7.45.0-1ubuntu1

7.46.0-1ubuntu1

7.47.0-1ubuntu1

7.47.0-1ubuntu2

7.47.0-1ubuntu2.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libcurl3": "7.47.0-1ubuntu2.2",
            "libcurl4-gnutls-dev": "7.47.0-1ubuntu2.2",
            "libcurl3-dbgsym": "7.47.0-1ubuntu2.2",
            "libcurl3-nss": "7.47.0-1ubuntu2.2",
            "libcurl4-doc": "7.47.0-1ubuntu2.2",
            "libcurl3-gnutls-dbgsym": "7.47.0-1ubuntu2.2",
            "libcurl4-openssl-dev": "7.47.0-1ubuntu2.2",
            "libcurl4-openssl-dev-dbgsym": "7.47.0-1ubuntu2.2",
            "curl-dbgsym": "7.47.0-1ubuntu2.2",
            "curl": "7.47.0-1ubuntu2.2",
            "libcurl4-nss-dev-dbgsym": "7.47.0-1ubuntu2.2",
            "libcurl3-gnutls": "7.47.0-1ubuntu2.2",
            "libcurl4-gnutls-dev-dbgsym": "7.47.0-1ubuntu2.2",
            "libcurl3-nss-dbgsym": "7.47.0-1ubuntu2.2",
            "libcurl3-dbg": "7.47.0-1ubuntu2.2",
            "libcurl4-nss-dev": "7.47.0-1ubuntu2.2"
        }
    ]
}