CVE-2016-8615 
Problem: curl: Cookie injection for other servers 
Impact: Moderate 
Business Impact: Threatens PCI Compliance
RedHat decision to fix: Will not fix 

CVE-2016-8616 
Problem: curl: Case insensitive password comparison 
Impact: Low 
Business Impact: Threatens PCI Compliance
RedHat decision to fix: Will not fix 

CVE-2016-8619 
Problem: curl: Double-free in krb5 code 
RedHat decision to fix: Will not fix 
Impact: Moderate 
Business Impact: Threatens PCI Compliance

CVE-2016-8621 
Problem: curl: curl_getdate out-of-bounds read 
RedHat decision to fix: Will not fix 
Impact: Low 
Business Impact: Threatens PCI Compliance

CVE-2016-8623 
Problem: curl: Use-after-free via shared cookies 
RedHat decision to fix: Will not fix 
Impact: Low 
Business Impact: Threatens PCI Compliance

CVE-2016-8624 
Problem: curl: Invalid URL parsing with '#' 
RedHat decision to fix: Will not fix 
Impact: Moderate 
Business Impact: Threatens PCI Compliance

CVE-2016-8625 
Problem: curl: IDNA 2003 makes curl use wrong host 
RedHat decision to fix: Will not fix 
Impact: Moderate
Business Impact: Threatens PCI Compliance


Version-Release number of selected component (if applicable):
curl 7.12.0 to and including 7.50.3
curl-7.15.5-17.el5_9.x86_64 specifically installed from RHEL sources

How reproducible:
This affected package gets installed to all deployments of RHEL6.8 (Possibly other versions as well)

Steps to Reproduce:
1. Deploy new installation of RHEL 6.8 with cURL installed
2. $ rpm -qa | grep -i curl
curl-7.15.5-17.el5_9.x86_64

Expected results:
A version not affected by the above listed CVE's. Either 

Additional info:
PCI Compliance / Audits require vendor supplied patches to active vulnerabilities within a timely manner as defined by current corp. vuln management policies. Current automated vulnerability scans are picking up the above mentioned version of cURL and listing these servers as vulnerable for a number of the CVE references listed above.