1. CVE-Search
  2. CVE-2007-3564
ID CVE-2007-3564
Summary libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SSL/TLS certificate expiration or activation dates, which allows remote attackers to bypass certain access restrictions.
References
Vulnerable Configurations
  • cpe:2.3:a:libcurl:libcurl:7.14:*:*:*:*:*:*:*
    cpe:2.3:a:libcurl:libcurl:7.14:*:*:*:*:*:*:*
  • cpe:2.3:a:libcurl:libcurl:7.14.1:*:*:*:*:*:*:*
    cpe:2.3:a:libcurl:libcurl:7.14.1:*:*:*:*:*:*:*
  • cpe:2.3:a:libcurl:libcurl:7.15:*:*:*:*:*:*:*
    cpe:2.3:a:libcurl:libcurl:7.15:*:*:*:*:*:*:*
  • cpe:2.3:a:libcurl:libcurl:7.15.1:*:*:*:*:*:*:*
    cpe:2.3:a:libcurl:libcurl:7.15.1:*:*:*:*:*:*:*
  • cpe:2.3:a:libcurl:libcurl:7.15.2:*:*:*:*:*:*:*
    cpe:2.3:a:libcurl:libcurl:7.15.2:*:*:*:*:*:*:*
  • cpe:2.3:a:libcurl:libcurl:7.15.3:*:*:*:*:*:*:*
    cpe:2.3:a:libcurl:libcurl:7.15.3:*:*:*:*:*:*:*
  • cpe:2.3:a:libcurl:libcurl:7.16.3:*:*:*:*:*:*:*
    cpe:2.3:a:libcurl:libcurl:7.16.3:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 29-07-2017 - 01:32)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 24938
debian DSA-1333
misc http://www.curl.haxx.se/docs/adv_20070710.html
secunia
  • 26104
  • 26108
  • 26128
  • 26231
trustix 2007-0023
ubuntu USN-484-1
vupen ADV-2007-2551
xf libcurl-gnutls-weak-security(35479)
statements via4
contributor Mark J Cox
lastmodified 2007-07-20
organization Red Hat
statement Not vulnerable. The curl packages as shipped with Red Hat Enterprise Linux versions 2.1, 3, 4 and 5 are not linked against the gnutls library.
Last major update 29-07-2017 - 01:32
Published 18-07-2007 - 17:30
Last modified 29-07-2017 - 01:32
Back to Top