Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2016-8623: curl shared cookies can leak data
CVE-2016-8623 · published 10 years ago
Summary
If your applications use curl (Debian or official builds) with cookie sharing across multiple threads, one thread can release cookie data while another is still reading it. This can cause private information to be exposed. Update curl to the latest version or avoid sharing cookies between threads, using separate handles or proper locking instead.
What to do
- Update debian curl to version 7.51.0-1.
- Update haxx curl to version 7.51.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | curl |
< 7.51.0-1 Fix: upgrade to 7.51.0-1
|
| Debian:13 | debian | curl |
< 7.51.0-1 Fix: upgrade to 7.51.0-1
|
| Debian:14 | debian | curl |
< 7.51.0-1 Fix: upgrade to 7.51.0-1
|
| – | haxx | curl |
< 7.51.0 cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
Original advisory text
Use after free via shared cookies
libcurl explicitly allows users to share cookies between multiple easy handles
that are concurrently employed by different threads.
When cookies to be sent to a server are collected, the matching function
collects all cookies to send and the cookie lock is released immediately
afterwards. That function however only returns a list with *references* back
to the original strings for name, value, path and so on. Therefore, if another
thread quickly takes the lock and frees one of the original cookie structs
together with its strings, a use after free can occur and lead to information
disclosure. Another thread can also replace the contents of the cookies from
separate HTTP responses or API calls.
that are concurrently employed by different threads.
When cookies to be sent to a server are collected, the matching function
collects all cookies to send and the cookie lock is released immediately
afterwards. That function however only returns a list with *references* back
to the original strings for name, value, path and so on. Therefore, if another
thread quickly takes the lock and frees one of the original cookie structs
together with its strings, a use after free can occur and lead to information
disclosure. Another thread can also replace the contents of the cookies from
separate HTTP responses or API calls.
References
- https://security-tracker.debian.org/tracker/CVE-2016-8623 Vendor Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch
- http://www.securityfocus.com/bid/94106 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1037192 Third Party Advisory VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2486 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3558 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8623 Issue Tracking Patch Third Party Advisory
- https://curl.haxx.se/CVE-2016-8623.patch Patch Vendor Advisory
- https://curl.haxx.se/docs/adv_20161102I.html Patch Vendor Advisory
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e3...
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8...
- https://security.gentoo.org/glsa/201701-47 Third Party Advisory
- https://www.tenable.com/security/tns-2016-21 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.5
High
Type
CWE-416Use After Free
Timeline
Published2 Nov 2016
Updated30 Oct 2026
First seen25 Apr 2026
Track software like this
Free during beta