{"schemaVersion":3,"id":"MGASA-2014-0153","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Updated curl packages fix multiple vulnerabilities\n\nUpdated curl packages fix security vulnerabilities:\n\nParas Sethia discovered that libcurl would sometimes mix up multiple HTTP\nand HTTPS connections with NTLM authentication to the same server, sending\nrequests for one user over the connection authenticated as a different user\n(CVE-2014-0015).\n\nlibcurl can in some circumstances re-use the wrong connection when asked to\ndo transfers using other protocols than HTTP and FTP, causing a transfer\nthat was initiated by an application to wrongfully re-use an existing\nconnection to the same server that was authenticated using different\ncredentials (CVE-2014-0138).\n\nlibcurl incorrectly validates wildcard SSL certificates containing literal\nIP addresses, so under certain conditions, it would allow and use a wildcard\nmatch specified in the CN field, allowing a malicious server to participate\nin a MITM attack or just fool users into believing that it is a legitimate\nsite (CVE-2014-0139).","dates":{"published":"2014-04-03T00:56:35.000Z","modified":"2026-04-16T06:24:33.789Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"mageia","product":"curl","name":"curl","label":"curl","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/curl","purlType":"rpm","versions":[{"text":"< 7.28.1-6.4.mga3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.28.1-6.4.mga3","eol":null,"hubHref":null},{"vendor":"mageia","product":"curl","name":"curl","label":"curl","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/curl","purlType":"rpm","versions":[{"text":"< 7.34.0-1.2.mga4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.34.0-1.2.mga4","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://advisories.mageia.org/MGASA-2014-0153.html","label":"advisories.mageia.org/MGASA-2014-0153.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"http://curl.haxx.se/docs/adv_20140129.html","label":"curl.haxx.se/docs/adv_20140129.html","hostname":"curl.haxx.se","tags":["WEB"]},{"url":"http://curl.haxx.se/docs/adv_20140326A.html","label":"curl.haxx.se/docs/adv_20140326A.html","hostname":"curl.haxx.se","tags":["WEB"]},{"url":"http://curl.haxx.se/docs/adv_20140326B.html","label":"curl.haxx.se/docs/adv_20140326B.html","hostname":"curl.haxx.se","tags":["WEB"]},{"url":"http://www.debian.org/security/2014/dsa-2849","label":"www.debian.org/security/2014/dsa-2849","hostname":"www.debian.org","tags":["WEB"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12476","label":"bugs.mageia.org/show_bug.cgi?id=12476","hostname":"bugs.mageia.org","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2014-0015","CVE-2014-0138","CVE-2014-0139"],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2014-04-03T00:56:35.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-16T06:24:33.789Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T07:30:26.204Z","stale":false,"partial":false}}