| Package | Affected versions | Patched versions |
|---|---|---|
| curl | = 7.20.0= 7.20.1= 7.21.0= 7.21.1= 7.21.2= 7.21.3= 7.21.4= 7.21.5= 7.21.6= 7.21.7= 7.22.0= 7.23.0= 7.23.1 | |
| libcurl | = 7.20.0= 7.20.1= 7.21.0= 7.21.1= 7.21.2= 7.21.3= 7.21.4= 7.21.5= 7.21.6= 7.21.7= 7.22.0= 7.23.0= 7.23.1 |
curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free