The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2015-04-24T14:00:00

Updated: 2024-08-06T05:39:31.551Z

Reserved: 2015-04-10T00:00:00

Link: CVE-2015-3144

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2015-04-24T14:59:09.203

Modified: 2024-11-21T02:28:45.997

Link: CVE-2015-3144

cve-icon Redhat

Severity : Low

Publid Date: 2015-04-22T00:00:00Z

Links: CVE-2015-3144 - Bugzilla