DEBIAN-CVE-2016-3739

DEBIAN-CVE-2016-3739 PUBLISHED CVSS 5.300000190734863 MEDIUM

The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.

Risk Scores

CVSS v3.0

5.300000190734863

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected Products

Vendor	Product	Versions
Debian:13	curl	0, 0, 0
Debian:12	curl	0, 0, 0
Debian:14	curl	0, 0, 0
Debian:11	curl	0, 0, 0

Timeline

May 20, 2016 CVE Published
Apr 28, 2026 CVE Updated

References

https://security-tracker.debian.org/tracker/CVE-2016-3739 advisory

Open in Interactive Console →