CVE-2014-3613

Description

cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.

References

https://support.apple.com/kb/HT205031

http://www.securityfocus.com/bid/69748

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.debian.org/security/2014/dsa-3022

http://rhn.redhat.com/errata/RHSA-2015-1254.html

http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00024.html

http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743

http://curl.haxx.se/docs/adv_20140910A.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3