CVE-2014-3620

Several security issues were fixed in curl ...

Two vulnerabilities have been discovered in cURL, an URL transfer library They can be use to leak cookie information: CVE-2014-3613 By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP cookies, libcurl can be fooled to both sending cookies to wrong sites and into allowing ...

libcurl wrongly allows cookies to be set for TLDs, thus making them much broader then they are supposed to be allowed to This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP ...

cURL and libcurl before 7380 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain ...