CVE-2014-3620
Fixed in a distro release EPSS 4%
cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.
Products: haxx curl, haxx libcurl, apple mac_os_x
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | curl | 7.38.0-1 |
| Debian 13 | curl | 7.38.0-1 |
| Debian 14 | curl | 7.38.0-1 |
| Ubuntu 14.04 LTS | curl | 7.35.0-1ubuntu2.1 |
| openSUSE Tumbleweed | curl | 7.51.0-1.1 |