CVE:CVE-2015-3153
CNNVD:CNNVD-201505-010
Haxx curl和libcurl都是瑞典Haxx公司的产品。curl是一套利用URL语法在命令行下工作的文件传输工具。libcurl是一个免费、开源的客户端URL传输库。
Haxx cURL 7.42.1之前版本和libcurl 7.42.1之前版本的默认配置中存在安全漏洞，该漏洞源于程序向代理服务器和目标服务器发送自定义的HTTP头。远程攻击者可通过读取HTTP头的内容利用该漏洞获取敏感信息。
solution:Upgrade oracle enterprise_manager_ops_center to a higher version than 12.1.3,12.2.0,12.2.1,12.3.0,and avoid the version (,12.1.3],12.2.0,12.2.1,12.3.0; Upgrade haxx curl to a higher version than 7.42.0,and avoid the version (,7.42.0]; Upgrade haxx libcurl to a higher version than 7.42.0,and avoid the version (,7.42.0]; Upgrade canonical ubuntu_linux to a higher version than 12.04,14.04,14.10,15.1,and avoid the version 12.04,14.04,14.10,15.1; Upgrade apple mac_os_x to a higher version than 10.10.4,and avoid the version 10.10.4; Upgrade debian debian_linux to a higher version than 8.0,and avoid the version 8.0