ALT-PU-2016-1956-1
Closed vulnerabilities
Published: 2016-10-04
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2016-7141
curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420.
Severity: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References:
- openSUSE-SU-2016:2379
- openSUSE-SU-2016:2379
- RHSA-2016:2575
- RHSA-2016:2575
- RHSA-2016:2957
- RHSA-2016:2957
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- 92754
- 92754
- 1036739
- 1036739
- RHSA-2018:3558
- RHSA-2018:3558
- https://bugzilla.redhat.com/show_bug.cgi?id=1373229
- https://bugzilla.redhat.com/show_bug.cgi?id=1373229
- https://curl.haxx.se/docs/adv_20160907.html
- https://curl.haxx.se/docs/adv_20160907.html
- https://github.com/curl/curl/commit/curl-7_50_2~32
- https://github.com/curl/curl/commit/curl-7_50_2~32
- [debian-lts-announce] 20181106 [SECURITY] [DLA 1568-1] curl security update
- [debian-lts-announce] 20181106 [SECURITY] [DLA 1568-1] curl security update
- GLSA-201701-47
- GLSA-201701-47