CVE-2016-5421

A use-after-free flaw was found in libcurl. When invoking curl_easy_perform() after cleaning up a multi session, an application can be tricked into using libcurl to connect to a malicious server, allowing an attacker to potentially execute arbitrary code. The highest threat from this vulnerability is to data confidentiality and integrity as well as data confidentiality.

The versions of curl as shipped with Red Hat Enterprise Linux 5, 6, and 7 are marked as "notaffected" because they did not include the vulnerable code, which was introduced in a later version of the package. Specifically, the struct field affected by this flaw was introduced in curl upstream version 7.32.0. The version of curl as shipped with Red Hat Enterprise Linux 7 is 7.29.0.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.