CVE-2015-3153

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-05-01 · updated 2026-06-17
Weakness: CWE-200

Description

The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.

Affected products

macOS: 10.10.4
Canonical Ubuntu Linux: 12.04, 14.04, 14.10, 15.1
Debian Linux: 8.0
curl: through 7.42.0
curl: through 7.42.0
Oracle Corporation Enterprise Manager Ops Center: through 12.1.3; 12.2.0, 12.2.1, 12.3.0

References

http://curl.haxx.se/docs/adv_20150429.html
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html
http://www.debian.org/security/2015/dsa-3240
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
http://www.securityfocus.com/bid/74408
http://www.securitytracker.com/id/1032233
http://www.ubuntu.com/usn/USN-2591-1

Get alerted when CVE-2015-3153 or the next vulnerability affects your stack