Skip to content
OpenAdvisories
Unscored USN-2346-1 2 CVEs

curl vulnerabilities

Published Sep 15, 2014 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Tim Ruehsen discovered that curl incorrectly handled partial literal IP
addresses. This could lead to the disclosure of cookies to the wrong site,
and malicious sites being able to set cookies for others. (CVE-2014-3613)

Tim Ruehsen discovered that curl incorrectly allowed cookies to be set
for Top Level Domains (TLDs). This could allow a malicious site to set a
cookie that gets sent to other sites. (CVE-2014-3620)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS curl 7.35.0-1ubuntu2.1

Vulnerabilities 2

  • Unscored —
    CVE-2014-3613

    cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attack…

    curl curl Debian Ubuntu
  • Unscored —
    CVE-2014-3620

    cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary si…

    curl curl Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2014-3613
  • report
    https://ubuntu.com/security/CVE-2014-3620