CVE-2015-3145

Name	CVE-2015-3145
Description	The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	high

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
curl (PTS)	stretch	7.52.1-5+deb9u10	fixed
	stretch (security)	7.52.1-5+deb9u14	fixed
	buster	7.64.0-4+deb10u1	fixed
	buster (security)	7.64.0-4+deb10u2	fixed
	bullseye, sid	7.74.0-1.2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
curl	source	squeeze	(not affected)
curl	source	wheezy	(not affected)
curl	source	jessie	7.38.0-4+deb8u1
curl	source	(unstable)	7.42.0-1

Notes

[wheezy] - curl <not-affected> (Affects 7.31.0 to and including 7.41.0)
[squeeze] - curl <not-affected> (Affects 7.31.0 to and including 7.41.0)
http://curl.haxx.se/docs/adv_20150422C.html