The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Multiple off-by-one errors in the cURL library (libcurl) 7.11.2 through 7.15.0 allow local users to trigger a buffer overflow and cause a denial of service or bypass PHP security restrictions via certain URLs that (1) are malformed in a way that prevents a terminating null byte from being added to either a hostname or path buffer, or (2) contain a "?" separator in the hostname portion, which causes a "/" to be prepended to the resulting string.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Curl | — | Apply OS X security update 2008-002 | Dec 16, 2011 | Dec 7, 2005 |
| Apple Osx Libcurl | — | Apply OS X security update 2006-003 | Dec 16, 2011 | Dec 7, 2005 |
| Debian | — | Upgrade curl | Jul 30, 2024 | Dec 8, 2005 |
| Freebsd | — | Upgrade curl | Dec 10, 2025 | Dec 9, 2005 |
| Gentoo Linux | — | Upgrade app-office/openoffice.Upgrade net-misc/curl.Upgrade app-office/openoffice-bin. | Oct 30, 2017 | Dec 7, 2005 |
| Ubuntu | — | Upgrade libcurl3 | Nov 8, 2024 | Dec 8, 2005 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub