CVE-2015-3148: Medium severity red hat fedora vulnerability
Published Apr 24, 2015
·Updated
cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.
Affected Software
159 affected components
Fedoraproject Fedora=21
Fedoraproject Fedora=22
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=14.10
Canonical Ubuntu Linux=15.04
Debian Debian Linux=7.0
Apple iOS and macOS=10.10.0
Apple iOS and macOS=10.10.1
Apple iOS and macOS=10.10.2
Apple iOS and macOS=10.10.3
Apple iOS and macOS=10.10.4
haxx libcurl=7.10.6
haxx libcurl=7.10.7
haxx libcurl=7.10.8
haxx libcurl=7.11.0
haxx libcurl=7.11.1
haxx libcurl=7.11.2
haxx libcurl=7.12.0
haxx libcurl=7.12.1
haxx libcurl=7.12.2
haxx libcurl=7.12.3
haxx libcurl=7.13.0
haxx libcurl=7.13.1
haxx libcurl=7.13.2
haxx libcurl=7.14.0
haxx libcurl=7.14.1
haxx libcurl=7.15.0
haxx libcurl=7.15.1
haxx libcurl=7.15.2
haxx libcurl=7.15.3
haxx libcurl=7.15.4
haxx libcurl=7.15.5
haxx libcurl=7.16.0
haxx libcurl=7.16.1
haxx libcurl=7.16.2
haxx libcurl=7.16.3
haxx libcurl=7.16.4
haxx libcurl=7.17.0
haxx libcurl=7.17.1
haxx libcurl=7.18.0
haxx libcurl=7.18.1
haxx libcurl=7.18.2
haxx libcurl=7.19.0
haxx libcurl=7.19.1
haxx libcurl=7.19.2
haxx libcurl=7.19.3
haxx libcurl=7.19.4
haxx libcurl=7.19.5
haxx libcurl=7.19.6
haxx libcurl=7.19.7
haxx libcurl=7.20.0
haxx libcurl=7.20.1
haxx libcurl=7.21.0
haxx libcurl=7.21.1
haxx libcurl=7.21.2
haxx libcurl=7.21.3
haxx libcurl=7.21.4
haxx libcurl=7.21.5
haxx libcurl=7.21.6
haxx libcurl=7.21.7
haxx libcurl=7.22.0
haxx libcurl=7.23.0
haxx libcurl=7.23.1
haxx libcurl=7.24.0
haxx libcurl=7.25.0
haxx libcurl=7.26.0
haxx libcurl=7.27.0
haxx libcurl=7.28.0
haxx libcurl=7.28.1
haxx libcurl=7.29.0
haxx libcurl=7.30.0
haxx libcurl=7.31.0
haxx libcurl=7.32.0
haxx libcurl=7.33.0
haxx libcurl=7.34.0
haxx libcurl=7.35.0
haxx libcurl=7.36.0
haxx libcurl=7.37.0
haxx libcurl=7.37.1
haxx libcurl=7.38.0
haxx libcurl=7.39
haxx libcurl=7.40.0
haxx libcurl=7.41.0
HP System Management Homepage<=7.5.3.1
haxx curl=7.10.6
haxx curl=7.10.7
haxx curl=7.10.8
haxx curl=7.11.0
haxx curl=7.11.1
haxx curl=7.11.2
haxx curl=7.12.0
haxx curl=7.12.1
haxx curl=7.12.2
haxx curl=7.12.3
haxx curl=7.13.0
haxx curl=7.13.1
haxx curl=7.13.2
haxx curl=7.14.0
haxx curl=7.14.1
haxx curl=7.15.0
haxx curl=7.15.1
haxx curl=7.15.2
haxx curl=7.15.3
haxx curl=7.15.4
haxx curl=7.15.5
haxx curl=7.16.0
haxx curl=7.16.1
haxx curl=7.16.2
haxx curl=7.16.3
haxx curl=7.16.4
haxx curl=7.17.0
haxx curl=7.17.1
haxx curl=7.18.0
haxx curl=7.18.1
haxx curl=7.18.2
haxx curl=7.19.0
haxx curl=7.19.1
haxx curl=7.19.2
haxx curl=7.19.3
haxx curl=7.19.4
haxx curl=7.19.5
haxx curl=7.19.6
haxx curl=7.19.7
haxx curl=7.20.0
haxx curl=7.20.1
haxx curl=7.21.0
haxx curl=7.21.1
haxx curl=7.21.2
haxx curl=7.21.3
haxx curl=7.21.4
haxx curl=7.21.5
haxx curl=7.21.6
haxx curl=7.21.7
haxx curl=7.22.0
haxx curl=7.23.0
haxx curl=7.23.1
haxx curl=7.24.0
haxx curl=7.25.0
haxx curl=7.26.0
haxx curl=7.27.0
haxx curl=7.28.0
haxx curl=7.28.1
haxx curl=7.29.0
haxx curl=7.30.0
haxx curl=7.31.0
haxx curl=7.32.0
haxx curl=7.33.0
haxx curl=7.34.0
haxx curl=7.35.0
haxx curl=7.36.0
haxx curl=7.37.0
haxx curl=7.37.1
haxx curl=7.38.0
haxx curl=7.39.0
haxx curl=7.40.0
haxx curl=7.41.0
openSUSE openSUSE=13.1
openSUSE openSUSE=13.2
Event History
Apr 24, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-3148?
CVE-2015-3148 has a medium severity rating due to its potential to allow remote attackers to connect as other users.
2
How do I fix CVE-2015-3148?
To fix CVE-2015-3148, you should upgrade to a version of curl or libcurl that is 7.42.0 or later.
3
Which software is affected by CVE-2015-3148?
CVE-2015-3148 affects curl and libcurl versions from 7.10.6 through 7.41.0.
4
Can CVE-2015-3148 be exploited remotely?
Yes, CVE-2015-3148 can be exploited remotely as it enables unauthorized access through improperly reused authenticated connections.
5
What platforms are impacted by CVE-2015-3148?
CVE-2015-3148 impacts various platforms, including multiple versions of Fedora, Ubuntu, Debian, and macOS.