{"id":"CVE-2014-3620","aliases":["CURL-CVE-2014-3620","DEBIAN-CVE-2014-3620","EUVD-2014-3583","GHSA-jcjc-gx52-c9q4","MGASA-2014-0385","UBUNTU-CVE-2014-3620","USN-2346-1","openSUSE-SU-2024:10303-1"],"status":"published","title":"cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set...","description":"cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0424,"percentile":0.91092,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2014-09-10T00:00:00Z","modified":"2026-10-25T01:05:02Z","fixes":[{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.38.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.38.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.38.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"curl","fixed_in":["7.35.0-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.38.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.38.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.38.0-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.34.0-1.3.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.1"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.1"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.51.0-1.1"}]}],"bundled":32}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"haxx","product":"curl"},{"vendor":"haxx","product":"libcurl"}],"references":[{"url":"http://www.securityfocus.com/bid/69742","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://curl.haxx.se/docs/adv_20140910B.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web","report"]},{"url":"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10743","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00024.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://support.apple.com/kb/HT205031","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-3022","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/05/11/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3620"},{"url":"https://github.com/advisories/GHSA-jcjc-gx52-c9q4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3620","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0385.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14088","tags":["report"]},{"url":"http://curl.haxx.se/docs/adv_20140910A.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-3620","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2346-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3620","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3613","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8625","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3620","description":"cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.","status":"published","published":"2014-11-18T15:00:00Z","modified":"2024-08-06T10:50:17.909Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2014-3583","description":"cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.","status":"published","published":"2014-11-18T15:00:00Z","modified":"2024-08-06T10:50:17Z","updated_at":"2026-11-03T01:57:10.446744Z"}],"ghsa":[{"id":"GHSA-jcjc-gx52-c9q4","title":"cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set...","description":"cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.","status":"published","published":"2022-05-12T00:02:08Z","modified":"2023-02-01T05:02:21Z","updated_at":"2026-11-02T14:49:53.323636Z"}],"nvd":[{"id":"CVE-2014-3620","description":"cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.","status":"published","published":"2014-11-18T15:59:01.39Z","modified":"2026-06-17T00:08:37.99Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"CURL-CVE-2014-3620","title":"cookie leak for TLDs","description":"libcurl wrongly allows cookies to be set for Top Level Domains (TLDs), thus\nmaking them apply broader than cookies are allowed. This can allow arbitrary\nsites to set cookies that then would get sent to a different and unrelated\nsite or domain.","status":"published","published":"2014-09-10T08:00:00Z","modified":"2026-10-25T01:05:02.665024331Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CVE-2014-3620","description":"cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.","status":"published","published":"2014-11-18T15:59:01Z","modified":"2026-04-16T06:16:00.859606226Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3620","description":"cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.","status":"published","published":"2014-11-18T15:59:01.39Z","modified":"2026-10-23T15:47:39.280777387Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0385","title":"Updated curl packages fix security vulnerabilities","description":"Updated curl packages fix security vulnerabilities:\n\nIn cURL before 7.38.0, libcurl can be fooled to both sending cookies to wrong\nsites and into allowing arbitrary sites to set cookies for others. For this\nproblem to trigger, the client application must use the numerical IP address\nin the URL to access the site (CVE-2014-3613).\n\nIn cURL before 7.38.0, libcurl wrongly allows cookies to be set for Top Level\nDomains (TLDs), thus making them apply broader than cookies are allowed. This\ncan allow arbitrary sites to set cookies that then would get sent to a\ndifferent and unrelated site or domain (CVE-2014-3620).\n","status":"published","published":"2014-09-24T16:44:28Z","modified":"2026-04-16T06:25:03.08217585Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10303-1","title":"curl-7.51.0-1.1 on GA media","description":"These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:23.860668Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2014-3620","description":"cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.","status":"published","published":"2014-09-10T00:00:00Z","modified":"2026-04-22T09:41:03.589387Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2346-1","title":"curl vulnerabilities","description":"Tim Ruehsen discovered that curl incorrectly handled partial literal IP\naddresses. This could lead to the disclosure of cookies to the wrong site,\nand malicious sites being able to set cookies for others. (CVE-2014-3613)\n\nTim Ruehsen discovered that curl incorrectly allowed cookies to be set\nfor Top Level Domains (TLDs). This could allow a malicious site to set a\ncookie that gets sent to other sites. (CVE-2014-3620)\n","status":"published","published":"2014-09-15T12:26:17Z","modified":"2026-04-22T09:00:09.089543Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}