CVE-2016-8625

Description

curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.

References

https://www.tenable.com/security/tns-2016-21

https://security.gentoo.org/glsa/201701-47

https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E

https://curl.haxx.se/docs/adv_20161102K.html

https://curl.haxx.se/CVE-2016-8625.patch

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8625

https://access.redhat.com/errata/RHSA-2018:3558

https://access.redhat.com/errata/RHSA-2018:2486

http://www.securitytracker.com/id/1037192

http://www.securityfocus.com/bid/94107

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3