CVE-2013-1944
Fixed in a distro release EPSS 4%
The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
Products: haxx curl, haxx libcurl, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | curl | 7.29.0-2.1 |
| Debian 13 | curl | 7.29.0-2.1 |
| Debian 14 | curl | 7.29.0-2.1 |
| Debian 6.0 | curl | 7.21.0-2.1+squeeze3 |
| Red Hat Enterprise Linux 5 | curl | 0:7.15.5-16.el5_9 |
| Red Hat Enterprise Linux 5 | curl-debuginfo | 0:7.15.5-16.el5_9 |
| Red Hat Enterprise Linux 5 | curl-devel | 0:7.15.5-16.el5_9 |
| Red Hat Enterprise Linux 6 | curl | 0:7.19.7-36.el6_4 |
| Red Hat Enterprise Linux 6 | curl-debuginfo | 0:7.19.7-36.el6_4 |
| Red Hat Enterprise Linux 6 | libcurl | 0:7.19.7-36.el6_4 |
| Red Hat Enterprise Linux 6 | libcurl-devel | 0:7.19.7-36.el6_4 |
| openSUSE Tumbleweed | curl | 7.51.0-1.1 |