CVE-2015-3153

The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.

• CWE-200

• http://curl.haxx.se/docs/adv_20150429.htmlVendor Advisory
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
• http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html
• http://www.debian.org/security/2015/dsa-3240Third Party Advisory
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
• http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlPatch, Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlPatch, Third Party Advisory
• http://www.securityfocus.com/bid/74408
• http://www.securitytracker.com/id/1032233Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2591-1Third Party Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10131
• https://support.apple.com/kb/HT205031Third Party Advisory
• http://curl.haxx.se/docs/adv_20150429.htmlVendor Advisory
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
• http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html
• http://www.debian.org/security/2015/dsa-3240Third Party Advisory
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
• http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlPatch, Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlPatch, Third Party Advisory
• http://www.securityfocus.com/bid/74408
• http://www.securitytracker.com/id/1032233Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2591-1Third Party Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10131
• https://support.apple.com/kb/HT205031Third Party Advisory

Published

May 1, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-3147daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool…6.5
• CVE-2015-3148cURL and libcurl 7.10.6 through 7.41.0 do not properly re-us…
• CVE-2015-3149The Hotspot component in OpenJDK8 as packaged in Red Hat Ent…
• CVE-2015-3150abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows loca…7.1
• CVE-2015-3151Directory traversal vulnerability in abrt-dbus in Automatic …7.8
• CVE-2015-3152Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka lib…5.9
• CVE-2015-3154CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zen…6.1
• CVE-2015-3155Foreman before 1.8.1 does not set the secure flag for the _s…
• CVE-2015-3156The _write_config function in trove/guestagent/datastore/exp…
• CVE-2015-3157Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2015-3158The invokeNextValve function in identity/federation/bindings…
• CVE-2015-3159The abrt-action-install-debuginfo-to-abrt-cache help program…7.8