The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.
2014-11-15T20:59:00.140
2025-04-12T10:46:40.837
Deferred
CVSSv2: 4.3 (MEDIUM)
AV:N/AC:M/Au:N/C:P/I:N/A:N
8.6
2.9
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Operating System | canonical | ubuntu_linux | 10.04 | Yes |
| Operating System | canonical | ubuntu_linux | 12.04 | Yes |
| Operating System | canonical | ubuntu_linux | 14.04 | Yes |
| Operating System | canonical | ubuntu_linux | 14.10 | Yes |
| Operating System | apple | mac_os_x | 10.10.0 | Yes |
| Operating System | apple | mac_os_x | 10.10.1 | Yes |
| Operating System | apple | mac_os_x | 10.10.2 | Yes |
| Operating System | apple | mac_os_x | 10.10.3 | Yes |
| Operating System | apple | mac_os_x | 10.10.4 | Yes |
| Operating System | opensuse | opensuse | 13.1 | Yes |
| Operating System | opensuse | opensuse | 13.2 | Yes |
| Application | oracle | hyperion | 11.1.2.2 | Yes |
| Application | oracle | hyperion | 11.1.2.3 | Yes |
| Operating System | debian | debian_linux | 7.0 | Yes |
| Operating System | debian | debian_linux | 8.0 | Yes |
| Application | haxx | libcurl | 7.17.1 | Yes |
| Application | haxx | libcurl | 7.18.0 | Yes |
| Application | haxx | libcurl | 7.18.1 | Yes |
| Application | haxx | libcurl | 7.18.2 | Yes |
| Application | haxx | libcurl | 7.19.0 | Yes |
| Application | haxx | libcurl | 7.19.1 | Yes |
| Application | haxx | libcurl | 7.19.2 | Yes |
| Application | haxx | libcurl | 7.19.3 | Yes |
| Application | haxx | libcurl | 7.19.4 | Yes |
| Application | haxx | libcurl | 7.19.5 | Yes |
| Application | haxx | libcurl | 7.19.6 | Yes |
| Application | haxx | libcurl | 7.19.7 | Yes |
| Application | haxx | libcurl | 7.20.0 | Yes |
| Application | haxx | libcurl | 7.20.1 | Yes |
| Application | haxx | libcurl | 7.21.0 | Yes |
| Application | haxx | libcurl | 7.21.1 | Yes |
| Application | haxx | libcurl | 7.21.2 | Yes |
| Application | haxx | libcurl | 7.21.3 | Yes |
| Application | haxx | libcurl | 7.21.4 | Yes |
| Application | haxx | libcurl | 7.21.5 | Yes |
| Application | haxx | libcurl | 7.21.6 | Yes |
| Application | haxx | libcurl | 7.21.7 | Yes |
| Application | haxx | libcurl | 7.22.0 | Yes |
| Application | haxx | libcurl | 7.23.0 | Yes |
| Application | haxx | libcurl | 7.23.1 | Yes |
| Application | haxx | libcurl | 7.24.0 | Yes |
| Application | haxx | libcurl | 7.25.0 | Yes |
| Application | haxx | libcurl | 7.26.0 | Yes |
| Application | haxx | libcurl | 7.27.0 | Yes |
| Application | haxx | libcurl | 7.28.0 | Yes |
| Application | haxx | libcurl | 7.28.1 | Yes |
| Application | haxx | libcurl | 7.29.0 | Yes |
| Application | haxx | libcurl | 7.30.0 | Yes |
| Application | haxx | libcurl | 7.31.0 | Yes |
| Application | haxx | libcurl | 7.32.0 | Yes |
| Application | haxx | libcurl | 7.33.0 | Yes |
| Application | haxx | libcurl | 7.34.0 | Yes |
| Application | haxx | libcurl | 7.35.0 | Yes |
| Application | haxx | libcurl | 7.36.0 | Yes |
| Application | haxx | libcurl | 7.37.0 | Yes |
| Application | haxx | libcurl | 7.37.1 | Yes |
| Application | haxx | libcurl | 7.38.0 | Yes |