Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.0
CVE-2014-3620: curl allows cross‑site cookie sharing
CVE-2014-3620 · published 12 years ago
Summary
The curl program and its libraries can mistakenly accept cookies that are set for top‑level domains, such as .com or .org. This means a malicious website could place a cookie that is then sent to unrelated sites, potentially exposing user data. Upgrade curl to the latest version or apply the recommended configuration changes that block cookies for top‑level domains.
What to do
- Update debian curl to version 7.38.0-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | curl |
< 7.38.0-1 Fix: upgrade to 7.38.0-1
|
| Debian:12 | debian | curl |
< 7.38.0-1 Fix: upgrade to 7.38.0-1
|
| Debian:13 | debian | curl |
< 7.38.0-1 Fix: upgrade to 7.38.0-1
|
| Debian:14 | debian | curl |
< 7.38.0-1 Fix: upgrade to 7.38.0-1
|
| – | haxx | curl |
<= 7.37.1 7.31.0 7.32.0 7.33.0 7.34.0 7.35.0 7.36.0 7.37.0 cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
| – | haxx | libcurl |
<= 7.37.1 7.31.0 7.32.0 7.33.0 7.34.0 7.35.0 7.36.0 7.37.0 cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* |
| – | apple | mac_os_x |
<= 10.10.4 cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* |
Original advisory text
cookie leak for TLDs
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs), thus
making them apply broader than cookies are allowed. This can allow arbitrary
sites to set cookies that then would get sent to a different and unrelated
site or domain.
making them apply broader than cookies are allowed. This can allow arbitrary
sites to set cookies that then would get sent to a different and unrelated
site or domain.
References
- https://security-tracker.debian.org/tracker/CVE-2014-3620 Vendor Advisory
- http://curl.haxx.se/docs/adv_20140910B.html Patch Vendor Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00024.html
- http://www.debian.org/security/2014/dsa-3022 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2022/05/11/2
- http://www.securityfocus.com/bid/69742
- https://support.apple.com/kb/HT205031 Vendor Advisory
Severity
5.0
Medium
Type
CWE-310Cryptographic Issues
Timeline
Published10 Sep 2014
Updated24 Oct 2026
First seen25 Apr 2026
Track software like this
Free during beta