CVE-2015-3143

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 11.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-04-24 · updated 2026-06-17
Weakness: CWE-264

Description

cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.

Affected products

macOS: through 10.9.5; 10.10.0, 10.10.1, 10.10.2, 10.10.3, 10.10.4
Canonical Ubuntu Linux: 12.04, 14.04, 14.10, 15.04
Debian Linux: 7.0
curl: 7.10.6, 7.10.7, 7.10.8, 7.11.0, 7.11.1, 7.11.2 (+65)
curl: 7.10.6, 7.10.7, 7.10.8, 7.11.0, 7.11.1, 7.11.2 (+66)
Hewlett Packard Enterprise System Management Homepage for Windows and Linux: through 7.5.3.1

References

http://advisories.mageia.org/MGASA-2015-0179.html
http://curl.haxx.se/docs/adv_20150422A.html
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156250.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html
http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html
http://marc.info/?l=bugtraq&m=145612005512270&w=2
http://rhn.redhat.com/errata/RHSA-2015-1254.html

Get alerted when CVE-2015-3143 or the next vulnerability affects your stack