curl / Docs / Vulnerability table / 7.50.0 vulnerabilities

Vulnerabilities in curl 7.50.0

curl version 7.50.0 was released on July 21 2016. The following 28 security problems are known to exist in this version.

FlawFrom versionTo and includingCVE
HTTP authentication leak in redirects6.07.57.0CVE-2018-1000007
HTTP/2 trailer out-of-bounds read7.
FTP wildcard out of bounds read7.
NTLM buffer overflow via integer overflow7.
IMAP FETCH response out of bounds read7.
FTP PWD response parser out of bounds read7.77.55.1CVE-2017-1000254
URL globbing out of bounds read7.
TFTP sends more than buffer size7.
--write-out out of buffer read6.57.53.1CVE-2017-7407
printf floating point buffer overflow7.17.51.0CVE-2016-9586
Win CE schannel cert wildcard matches too much7.
Win CE schannel cert name out of buffer read7.
cookie injection for other servers7.17.50.3CVE-2016-8615
case insensitive password comparison7.77.50.3CVE-2016-8616
OOB write via unchecked multiplication7.17.50.3CVE-2016-8617
double-free in curl_maprintf7.17.50.3CVE-2016-8618
double-free in krb5 code7.37.50.3CVE-2016-8619
glob parser write/read out of bounds7.
curl_getdate read out of bounds7.
URL unescape heap overflow via integer truncation7.
Use-after-free via shared cookies7.
invalid URL parsing with '#'
IDNA 2003 makes curl use wrong host7.
curl escape and unescape integer overflows7.
Incorrect reuse of client certificates7.
TLS session resumption client cert bypass7.17.50.0CVE-2016-5419
Re-using connections with wrong client cert7.17.50.0CVE-2016-5420
use of connection struct after free7.

Changelog for curl 7.50.0

See vulnerability summary for the previous release: 7.49.1 or the subsequent release: 7.50.1