What’s Vulnerable › Vulnerabilities

CVE-2016-0755

• Severity: high (CVSS 7.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 9.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-01-29 · updated 2026-06-17
• Weakness: CWE-287

Description

The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.

Affected products

• Canonical Ubuntu Linux: 12.04, 14.04, 15.04, 15.10
• Debian Linux: 7.0
• curl: through 7.46.0

References

• http://curl.haxx.se/docs/adv_20160127A.html
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176546.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177342.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177383.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176413.html
• http://lists.opensuse.org/opensuse-updates/2016-02/msg00031.html
• http://lists.opensuse.org/opensuse-updates/2016-02/msg00044.html
• http://lists.opensuse.org/opensuse-updates/2016-02/msg00047.html
• http://packetstormsecurity.com/files/135695/Slackware-Security-Advisory-curl-Updates.html
• http://www.debian.org/security/2016/dsa-3455
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Get alerted when CVE-2016-0755 or the next vulnerability affects your stack