← Back to branch summary

~ubuntu-security/ubuntu-cve-tracker/master

« back to all changes in this revision

Viewing changes to retired/CVE-2014-3613

  • Committer: Steve Beattie
  • Date: 2019-02-19 06:18:27 UTC
  • Revision ID: sbeattie@ubuntu.com-20190219061827-oh57fzcfc1u9dlfk
The ubuntu-cve-tracker project has been converted to git.

Please use 'git clone https://git.launchpad.net/ubuntu-cve-tracker' to
get the converted tree.

Show diffs side-by-side

added added

removed removed

Lines of Context:
retired/CVE-2014-3613
1
 
PublicDateAtUSN: 2014-09-10
2
 
Candidate: CVE-2014-3613
3
 
PublicDate: 2014-11-18
4
 
References:
5
 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3613
6
 
 http://curl.haxx.se/docs/adv_20140910A.html
7
 
 https://usn.ubuntu.com/usn/usn-2346-1
8
 
Description:
9
 
 cURL and libcurl before 7.38.0 does not properly handle IP addresses in
10
 
 cookie domain names, which allows remote attackers to set cookies for or
11
 
 send arbitrary cookies to certain sites, as demonstrated by a site at
12
 
 192.168.0.1 setting cookies for a site at 127.168.0.1.
13
 
Ubuntu-Description:
14
 
Notes:
15
 
Bugs:
16
 
Priority: medium
17
 
Discovered-by: Tim Ruehsen
18
 
Assigned-to: mdeslaur
19
 
 
20
 
Patches_curl:
21
 
 vendor: https://www.debian.org/security/2014/dsa-3022
22
 
upstream_curl: released (7.38.0)
23
 
lucid_curl: released (7.19.7-1ubuntu1.9)
24
 
precise_curl: released (7.22.0-3ubuntu4.10)
25
 
trusty_curl: released (7.35.0-1ubuntu2.1)
26
 
devel_curl: released (7.37.1-1ubuntu2)