The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Aug 30, 2017 | Jan 29, 2016 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Nov 11, 2016 | Jan 29, 2016 |
| Debian | — | Upgrade curl | Feb 2, 2016 | Jan 27, 2016 |
| Freebsd | — | Upgrade curl | Dec 10, 2025 | Jan 27, 2016 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Oct 30, 2017 | Jan 29, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libcurlUpgrade curlUpgrade libcurl-devel | Dec 4, 2019 | Jan 29, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libcurlUpgrade curlUpgrade libcurl-devel | Sep 25, 2019 | Jan 29, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libcurlUpgrade curlUpgrade libcurl-devel | Jun 27, 2019 | Jan 29, 2016 |
| Oracle Solaris | — | Upgrade web/curl to version 7.45.0-0.175.3.14.0.1.0 on Solaris 11.3 | May 29, 2017 | Jan 29, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 27, 2016 |
| Suse | — | Upgrade curlUpgrade sles11sp4-docker-imageUpgrade libcurl-develUpgrade libcurl4-openssl1-32bitUpgrade libcurl4Upgrade libcurl4-x86Upgrade curl-openssl1Upgrade libcurl4-openssl1Upgrade libcurl4-32bit | Feb 4, 2016 | Jan 29, 2016 |
| Ubuntu | — | Upgrade libcurl3Upgrade libcurl3-nssUpgrade libcurl3-gnutls | Feb 2, 2016 | Jan 27, 2016 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 29, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub