Home

CVE-2016-7141

Description

curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420.

Risk Information

Base Score
7.5
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
Exploitation Probability
0.524

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2016-7141,CVE-2017-1000100,CVE-2017-1000101,CVE-2017-1000254 are affected in Curl For Windows 7.50.1Windows
Vulnerabilities CVE-2016-7141 are fixed in Curl For Windows 7.50.2Windows
HTTP, HTTPS, and FTP client and client libraries (USN-1801-1) curl_7.22.0-3ubuntu4.17_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-1801-1) curl_7.22.0-3ubuntu4.17_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3_7.47.0-1ubuntu2.2_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3_7.47.0-1ubuntu2.2_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3_7.22.0-3ubuntu4.17_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3_7.22.0-3ubuntu4.17_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3_7.35.0-1ubuntu2.10_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3_7.35.0-1ubuntu2.10_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3-nss_7.47.0-1ubuntu2.2_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3-nss_7.47.0-1ubuntu2.2_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3-nss_7.22.0-3ubuntu4.17_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3-nss_7.22.0-3ubuntu4.17_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3-nss_7.35.0-1ubuntu2.10_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3-nss_7.35.0-1ubuntu2.10_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3-gnutls_7.47.0-1ubuntu2.2_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3-gnutls_7.47.0-1ubuntu2.2_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3-gnutls_7.22.0-3ubuntu4.17_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3-gnutls_7.22.0-3ubuntu4.17_amd64.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3-gnutls_7.35.0-1ubuntu2.10_i386.debLinux
HTTP, HTTPS, and FTP client and client libraries (USN-3123-1) libcurl3-gnutls_7.35.0-1ubuntu2.10_amd64.debLinux
Curl 7.35.0-1ubuntu2.10 for Ubuntu 14.04 LTS (x64) curl_7.35.0-1ubuntu2.10_amd64.debLinux
Curl 7.35.0-1ubuntu2.10 for Ubuntu 14.04 LTS curl_7.35.0-1ubuntu2.10_i386.debLinux
Curl 7.47.0-1ubuntu2.2 for Ubuntu 16.04 LTS (x64) curl_7.47.0-1ubuntu2.2_amd64.debLinux
Curl 7.47.0-1ubuntu2.2 for Ubuntu 16.04 LTS curl_7.47.0-1ubuntu2.2_i386.debLinux
Curl 7.50.1-1ubuntu1.1 for Ubuntu 16.10 (x64) curl_7.50.1-1ubuntu1.1_amd64.debLinux
Curl 7.50.1-1ubuntu1.1 for Ubuntu 16.10 curl_7.50.1-1ubuntu1.1_i386.debLinux
Improper Authentication Vulnerability (CVE-2016-7141)NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234