Unscored severity · published Nov 18, 2014
CVE-2014-3613
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain…
–
CVSS
7.1%
EPSS
No
On KEV
Description
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.1% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
Curl · Haxx
through 7.37.1; 7.31.0; 7.32.0; 7.33.0; 7.34.0; 7.35.0; +2 more · source: NVD
LI
Libcurl · Haxx
through 7.37.1; 7.31.0; 7.32.0; 7.33.0; 7.34.0; 7.35.0; +2 more · source: NVD
MO
Mac OS X · Apple
through 10.10.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3613
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3613
Patch
http://curl.haxx.se/docs/adv_20140910A.html
kb.juniper.net
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
lists.apple.com
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00024.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-1254.html
Vendor Advisory
http://www.debian.org/security/2014/dsa-3022
More from Mac OS X
9.8
CVE-2021-1871
Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
9.8
CVE-2021-1870
Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
9.8
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability
8.8
CVE-2022-2294
WebRTC Heap Buffer Overflow Vulnerability
8.8
CVE-2021-1789
Apple Multiple Products Type Confusion Vulnerability