Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 2 |
CVE-ID | CVE-2014-3620 CVE-2014-3613 |
CWE-ID | CWE-310 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
cURL Client/Desktop applications / Other client software libcurl Universal components / Libraries / Libraries used by multiple products |
Vendor | curl.haxx.se |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU41096
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2014-3620
CWE-ID:
CWE-310 - Cryptographic Issues
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to manipulate data.
cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.
MitigationInstall update from vendor's website.
Vulnerable software versionscURL: 7.31.0 - 7.37.0
libcurl: 7.31.0 - 7.37.0
External linkshttp://curl.haxx.se/docs/adv_20140910B.html
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00024.html
http://www.debian.org/security/2014/dsa-3022
http://www.securityfocus.com/bid/69742
http://support.apple.com/kb/HT205031
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU41097
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2014-3613
CWE-ID:
CWE-310 - Cryptographic Issues
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to manipulate data.
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.
MitigationInstall update from vendor's website.
Vulnerable software versionscURL: 7.31.0 - 7.37.0
libcurl: 7.31.0 - 7.37.0
External linkshttp://curl.haxx.se/docs/adv_20140910A.html
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00024.html
http://rhn.redhat.com/errata/RHSA-2015-1254.html
http://www.debian.org/security/2014/dsa-3022
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.securityfocus.com/bid/69748
http://support.apple.com/kb/HT205031
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.