Unrated severityNVD Advisory· Published Mar 5, 2009· Updated Apr 23, 2026
CVE-2009-0037
CVE-2009-0037
Description
The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.
Affected products
80cpe:2.3:a:curl:curl:7.10.2:*:*:*:*:*:*:*+ 63 more
- cpe:2.3:a:curl:curl:7.10.2:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.10.3:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.10.5:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.10.6:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.10.7:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.10.8:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.12:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.12.2:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.13:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.13.2:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.14:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.14.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.15:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.15.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.15.3:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.16.3:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.16.4:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:5.11:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:6.1beta:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:6.2:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:6.3:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:6.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:6.4:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:6.5:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:6.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:6.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.2:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.3:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.4:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.5:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.6:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.7:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.8:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.9:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.9.3:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.9.4:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.9.5:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.9.6:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.9.7:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.9.8:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.10:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.17:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.18:*:*:*:*:*:*:*
- cpe:2.3:a:curl:curl:7.19.3:*:*:*:*:*:*:*
cpe:2.3:a:curl:libcurl:5.11:*:*:*:*:*:*:*+ 15 more
- cpe:2.3:a:curl:libcurl:5.11:*:*:*:*:*:*:*
- cpe:2.3:a:curl:libcurl:7.12:*:*:*:*:*:*:*
- cpe:2.3:a:curl:libcurl:7.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:libcurl:7.12.2:*:*:*:*:*:*:*
- cpe:2.3:a:curl:libcurl:7.12.3:*:*:*:*:*:*:*
- cpe:2.3:a:curl:libcurl:7.13:*:*:*:*:*:*:*
- cpe:2.3:a:curl:libcurl:7.13.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:libcurl:7.13.2:*:*:*:*:*:*:*
- cpe:2.3:a:curl:libcurl:7.14:*:*:*:*:*:*:*
- cpe:2.3:a:curl:libcurl:7.14.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:libcurl:7.15:*:*:*:*:*:*:*
- cpe:2.3:a:curl:libcurl:7.15.1:*:*:*:*:*:*:*
- cpe:2.3:a:curl:libcurl:7.15.2:*:*:*:*:*:*:*
- cpe:2.3:a:curl:libcurl:7.15.3:*:*:*:*:*:*:*
- cpe:2.3:a:curl:libcurl:7.16.3:*:*:*:*:*:*:*
- cpe:2.3:a:curl:libcurl:7.19.3:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
32- curl.haxx.se/docs/adv_20090303.htmlnvdPatchVendor Advisory
- curl.haxx.se/lxr/source/CHANGESnvdPatchVendor Advisory
- www.vupen.com/english/advisories/2009/0581nvdPatchVendor Advisory
- www.securityfocus.com/bid/33962nvdExploitPatch
- secunia.com/advisories/34138nvdVendor Advisory
- lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.htmlnvd
- lists.vmware.com/pipermail/security-announce/2009/000060.htmlnvd
- secunia.com/advisories/34202nvd
- secunia.com/advisories/34237nvd
- secunia.com/advisories/34251nvd
- secunia.com/advisories/34255nvd
- secunia.com/advisories/34259nvd
- secunia.com/advisories/34399nvd
- secunia.com/advisories/35766nvd
- security.gentoo.org/glsa/glsa-200903-21.xmlnvd
- slackware.com/security/viewer.phpnvd
- support.apple.com/kb/HT4077nvd
- wiki.rpath.com/wiki/Advisories:rPSA-2009-0042nvd
- www.debian.org/security/2009/dsa-1738nvd
- www.redhat.com/support/errata/RHSA-2009-0341.htmlnvd
- www.securityfocus.com/archive/1/501757/100/0/threadednvd
- www.securityfocus.com/archive/1/504849/100/0/threadednvd
- www.securitytracker.com/idnvd
- www.ubuntu.com/usn/USN-726-1nvd
- www.vmware.com/security/advisories/VMSA-2009-0009.htmlnvd
- www.vupen.com/english/advisories/2009/1865nvd
- www.withdk.com/2009/03/03/curllibcurl-redirect-arbitrary-file-access/nvd
- www.withdk.com/archives/Libcurl_arbitrary_file_access.pdfnvd
- exchange.xforce.ibmcloud.com/vulnerabilities/49030nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11054nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6074nvd
News mentions
0No linked articles in our index yet.