curl / Docs / Vulnerability table / 7.42.1 vulnerabilities

Vulnerabilities in curl 7.42.1

curl version 7.42.1 was released on April 29 2015. The following 26 security problems are known to exist in this version.

FlawFrom versionTo and includingCVE
--write-out out of buffer read6.57.53.1CVE-2017-7407
printf floating point buffer overflow7.17.51.0CVE-2016-9586
Win CE schannel cert wildcard matches too much7.
Win CE schannel cert name out of buffer read7.
cookie injection for other servers7.17.50.3CVE-2016-8615
case insensitive password comparison7.77.50.3CVE-2016-8616
OOB write via unchecked multiplication7.17.50.3CVE-2016-8617
double-free in curl_maprintf7.17.50.3CVE-2016-8618
double-free in krb5 code7.37.50.3CVE-2016-8619
glob parser write/read out of bounds7.
curl_getdate read out of bounds7.
URL unescape heap overflow via integer truncation7.
Use-after-free via shared cookies7.
invalid URL parsing with '#'
IDNA 2003 makes curl use wrong host7.
curl escape and unescape integer overflows7.
Incorrect reuse of client certificates7.
TLS session resumption client cert bypass7.17.50.0CVE-2016-5419
Re-using connections with wrong client cert7.17.50.0CVE-2016-5420
use of connection struct after free7.
Windows DLL hijacking7.
TLS certificate check bypass with mbedTLS/PolarSSL7.
remote file name path traversal in curl tool for Windows7.
NTLM credentials not-checked for proxy connection re-use7.
SMB send off unrelated memory contents7.
lingering HTTP credentials in connection re-use7.

Changelog for curl 7.42.1

See vulnerability summary for the previous release: 7.42.0 or the subsequent release: 7.43.0