CVE-2016-0755: canonical ubuntu_linux Improper Authentication
CVSS: 7.3v3.0HighModified
AliasesMGASA-2016-0050SUSE-SU-2016:0340-1SUSE-SU-2016:0347-1UBUNTU-CVE-2016-0755USN-2882-1DEBIAN-CVE-2016-0755DSA-3455-1
Published 29-01-2016Last modified 05-08-2024
Vulnerability summary
CVE-2016-0755 is a high (CVSS 7.3) Improper Authentication vulnerability in canonical ubuntu_linux. EPSS estimates a 9.08% chance of exploitation in the next 30 days, higher than 95.2% of scored vulnerabilities.
CVSS score
7.3/10
010
High · v3.0 (NVD)EPSS score
9.08%
0%100%
Low · -0.25 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 29-01-2016PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.3Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · DebianEcosystem advisory · calculated7.3HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
9.08%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
-0.25 pp
From 9.33% on 18-09-2026
18-09-202618-10-2026
EPSS score9.08%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse17 products
- curl&distro=SUSE Linux Enterprise Desktop 11 SP3< 7.19.7-1.46.1
- curl&distro=SUSE Linux Enterprise Desktop 11 SP4< 7.19.7-1.46.1
- curl&distro=SUSE Linux Enterprise Desktop 12< 7.37.0-18.1
- curl&distro=SUSE Linux Enterprise Desktop 12 SP1< 7.37.0-18.1
- curl&distro=SUSE Linux Enterprise Server 11 SP3< 7.19.7-1.46.1
Debian2 products
- curl< 7.47.0-1 | < 7.38.0-4+deb8u3
- debian_linuxEOL7.0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 15.04 | 15.10
Haxx1 product
- curl≤ 7.46.0
Mageia1 product
- curl< 7.40.0-3.3.mga5
Ubuntu1 product
- curl< 7.35.0-1ubuntu2.6
6 vendors · 23 products
References
32 links- lists.fedoraproject.org/pipermail/package-announce/2016-January/176413.htmlVendor AdvisoryX Refsource FEDORA
- lists.fedoraproject.org/pipermail/package-announce/2016-February/176546.htmlVendor AdvisoryX Refsource FEDORA
- www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.519965Vendor AdvisoryX Refsource SLACKWARE
- www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlX Refsource CONFIRM
Show all 32 references
- support.apple.com/HT207170X Refsource CONFIRM
- lists.fedoraproject.org/pipermail/package-announce/2016-February/177383.htmlVendor AdvisoryX Refsource FEDORA
- lists.fedoraproject.org/pipermail/package-announce/2016-February/177342.htmlVendor AdvisoryX Refsource FEDORA
- bugzilla.suse.com/934333REPORT
- bugzilla.suse.com/936676REPORT
- bugzilla.suse.com/962983REPORT
- bugzilla.suse.com/962996REPORT
- bugzilla.suse.com/926511REPORT