CVE-2012-0036 curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafte...
HighCVSS 7.5
EPSS 16.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/curl(Debian:12) | < 7.24.0-1 | 7.24.0-1 |
| debian/curl(Debian:13) | < 7.24.0-1 | 7.24.0-1 |
| debian/curl(Debian:14) | < 7.24.0-1 | 7.24.0-1 |
| curl | = 7.20.0 | No fix listed |
| curl | = 7.20.1 | No fix listed |
| curl | = 7.21.0 | No fix listed |
| curl | = 7.21.1 | No fix listed |
| curl | = 7.21.2 | No fix listed |
| curl | = 7.21.3 | No fix listed |
| curl | = 7.21.4 | No fix listed |
| curl | = 7.21.5 | No fix listed |
| curl | = 7.21.6 | No fix listed |
| curl | = 7.21.7 | No fix listed |
| curl | = 7.22.0 | No fix listed |
| curl | = 7.23.0 | No fix listed |
| curl | = 7.23.1 | No fix listed |
| curl libcurl | = 7.20.0 | No fix listed |
| curl libcurl | = 7.20.1 | No fix listed |
| curl libcurl | = 7.21.0 | No fix listed |
| curl libcurl | = 7.21.1 | No fix listed |
| curl libcurl | = 7.21.2 | No fix listed |
| curl libcurl | = 7.21.3 | No fix listed |
| curl libcurl | = 7.21.4 | No fix listed |
| curl libcurl | = 7.21.5 | No fix listed |
| curl libcurl | = 7.21.6 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| curl libcurl | = 7.21.7 | No fix listed |
| curl libcurl | = 7.22.0 | No fix listed |
| curl libcurl | = 7.23.0 | No fix listed |
| curl libcurl | = 7.23.1 | No fix listed |
References
- Debian Security Tracker CVE-2012-0036 vendor-advisory
- curl.haxx.se patch
- curl.haxx.se vendor-advisory
- HPSBMU02786 vendor-advisory
- APPLE-SA-2012-05-09-1 vendor-advisory
- 48256 third-party-advisory
- GLSA-201203-02 vendor-advisory
- support.apple.com
- DSA-2398 vendor-advisory
- MDVSA-2012:058 vendor-advisory
- www.oracle.com
- 51665 vdb-entry
- 1032924 vdb-entry
- bugzilla.redhat.com
- github.com
- h20566.www2.hpe.com