CVE-2012-0036
EPSS 16.7%
描述
curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol.
如何修補 CVE-2012-0036
要修補 CVE-2012-0036,請將受影響套件升級到下列已修補版本。
- Debian/curl—升級至 7.24.0-1 或更新版本
CVE-2012-0036 正在被利用嗎?
中等 — EPSS 為 16.7%,可持續追蹤但非最高優先。
受影響套件(1)
- from 0, < 7.24.0-1