CVE-2005-4077 - CVE House
Back to Database
Status published Medium CVE-2005-4077

Multiple off-by-one errors in the cURL library (libcurl) 7.11.2 through...

Vulnerability Description

Multiple off-by-one errors in the cURL library (libcurl) 7.11.2 through 7.15.0 allow local users to trigger a buffer overflow and cause a denial of service or bypass PHP security restrictions via certain URLs that (1) are malformed in a way that prevents a terminating null byte from being added to either a hostname or path buffer, or (2) contain a "?" separator in the hostname portion, which causes a "/" to be prepended to the resulting string.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2005-4077

Credits & Attribution

No credits recorded in the NVD database.

References

More from daniel stenberg

View All →
CVE-2007-3153
The ares_init:randomize_key function in c-ares, on platforms other than Windows,...
Medium 5
CVE-2007-3152
c-ares before 1.4.0 uses a predictable seed for the random...
High 7.5
CVE-2006-1061
Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2...
High 7.5
CVE-2002-1868
Dispair 0.1 and 0.2 allows remote attackers to execute arbitrary...
Critical 10
CVE-2000-0973
Buffer overflow in curl earlier than 6.0-1.1, and curl-ssl earlier...
Critical 10

Affected Vendor

daniel stenberg

View all reports →

Affected Software

curl
Vulnerable Versions:
7.11.2, 7.12, 7.12.1, 7.12.2, 7.12.3, 7.13, 7.13.1, 7.13.2, 7.14, 7.14.1, 7.15

Timeline

Official Publish: December 8th, 2005
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.