SB2014091108 - Fedora 21 update for curl 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2014091108

SB2014091108 - Fedora 21 update for curl

Published: September 11, 2014 Updated: April 24, 2025

Security Bulletin ID SB2014091108
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Cryptographic issues (CVE-ID: CVE-2014-3613)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.


2) Cryptographic issues (CVE-ID: CVE-2014-3620)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.


Remediation

Install update from vendor's website.

References