Bug Bounty Bug Report Code of conduct Dependencies Donate FAQ Features Governance History Install Known Bugs Logo TODO website Info

CA Extract HTTP cookies HTTP/3 MQTT SSL certs SSL libs compared URL syntax WebSocket

Changelog curl CVEs Release Table Version Numbering Vulnerabilities

Tool

Comparison Table curl man page HTTP Scripting mk-ca-bundle Tutorial When options were added

Companies Copyright Sponsors Thanks The name

curl / Docs / Vulnerability table / 6.2 vulnerabilities

Vulnerabilities in curl 6.2

Related:
Audits
Bug Bounty
Changelog
curl CVEs
Vulnerability Disclosure
Vulnerabilities Table

curl version 6.2 was released on October 21 1999

It has the following 18 published security problems.

Flaw	From version	To and including
control code in cookie denial of service	4.9	7.84.0
Auth/cookie leak on redirect	4.9	7.82.0
Credential leak on redirect	4.9	7.82.0
trusting FTP PASV responses	4.0	7.73.0
HTTP authentication leak in redirects	6.0	7.57.0
printf floating point buffer overflow	5.4	7.51.0
cookie injection for other servers	4.9	7.50.3
double free in curl_maprintf	5.4	7.50.3
invalid URL parsing with '#'	6.0	7.50.3
TLS session resumption client cert bypass	5.0	7.50.0
remote filename path traversal in curl tool for Windows	4.0	7.46.0
sensitive HTTP server headers also sent to proxies	4.0	7.42.0
URL request injection	6.0	7.39.0
cookie leak with IP address as domain	4.0	7.37.1
cookie domain tailmatch	4.7	7.29.0
Arbitrary File Access	5.11	7.19.3
Proxy Authentication Header Information Leakage	4.5	7.10.6
FTP Server Response Buffer Overflow	6.0	7.4

Further details

CVE data for 6.2 provided as JSON.

Changelog for curl 6.2

See vulnerability summary for the previous release: 6.1 or the subsequent release: 6.3