CVE:CVE-2015-3144
CNNVD:CNNVD-201504-501
Haxx curl和libcurl都是瑞典Haxx公司的产品。curl是一套利用URL语法在命令行下工作的文件传输工具。libcurl是一个免费、开源的客户端URL传输库。
Haxx cURL和libcurl 7.37.0版本至7.41.0版本的‘fix_hostname’函数中存在安全漏洞，该漏洞源于程序没有正确计算索引。远程攻击者可借助零长度的域名利用该漏洞造成拒绝服务（越边界读取或写入，崩溃）。
solution:Upgrade oracle mysql_enterprise_monitor to a higher version than 2.3.20,3.0.22,and avoid the version (,2.3.20],(,3.0.22]; Upgrade haxx curl to a higher version than 7.37.0,7.37.1,7.38.0,7.39.0,7.40.0,7.41.0,and avoid the version 7.37.0,7.37.1,7.38.0,7.39.0,7.40.0,7.41.0; Upgrade haxx libcurl to a higher version than 7.37.0,7.37.1,7.38.0,7.39,7.40.0,7.41.0,and avoid the version 7.37.0,7.37.1,7.38.0,7.39,7.40.0,7.41.0; Upgrade canonical ubuntu_linux to a higher version than 12.04,14.04,14.10,15.04,and avoid the version 12.04,14.04,14.10,15.04; Upgrade debian debian_linux to a higher version than 7.0,and avoid the version 7.0