CVE-2016-8625
UnknownEPSS 4.32%
Last modified
CVE-2016-8625 is a vulnerability of currently unknown severity. curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.. EPSS estimates a 4.32% chance of exploitation in the next 30 days.
Description
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Haxx | Curl | < 7.51.0 |
References
- http://www.securityfocus.com/bid/94107Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037192Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2486Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3558Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8625Issue Tracking, Patch, Third Party Advisory
- https://curl.haxx.se/CVE-2016-8625.patchPatch, Vendor Advisory
- https://curl.haxx.se/docs/adv_20161102K.htmlPatch, Vendor Advisory
- https://security.gentoo.org/glsa/201701-47Third Party Advisory
- https://www.tenable.com/security/tns-2016-21Third Party Advisory
- http://www.securityfocus.com/bid/94107Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037192Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2486Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3558Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8625Issue Tracking, Patch, Third Party Advisory
- https://curl.haxx.se/CVE-2016-8625.patchPatch, Vendor Advisory
- https://curl.haxx.se/docs/adv_20161102K.htmlPatch, Vendor Advisory
- https://security.gentoo.org/glsa/201701-47Third Party Advisory
- https://www.tenable.com/security/tns-2016-21Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-8625?
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.
How severe is CVE-2016-8625?
Severity scoring for CVE-2016-8625 is pending analysis. The EPSS model estimates a 4.32% probability of exploitation in the next 30 days.
How do I fix CVE-2016-8625?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2016-8625?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST