{"id":"CVE-2014-3707","aliases":["CURL-CVE-2014-3707","DEBIAN-CVE-2014-3707","DLA-84-1","DSA-3069-1","EUVD-2014-3653","GHSA-x89w-3fj3-7gmx","MGASA-2014-0444","RHSA-2015:1254","RHSA-2015:2159","UBUNTU-CVE-2014-3707","USN-2399-1"],"status":"published","title":"The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the...","description":"The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.05121,"percentile":0.92436,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2014-11-05T00:00:00Z","modified":"2026-10-26T13:07:54Z","fixes":[{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.38.0-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.38.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.38.0-3"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"curl","fixed_in":["7.21.0-2.1+squeeze10"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"curl","fixed_in":["7.26.0-1+wheezy11"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"curl","fixed_in":["7.28.1-6.6.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"curl","fixed_in":["7.34.0-1.4.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"curl","fixed_in":["7.35.0-1ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.38.0-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.38.0-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.38.0-3"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.21.0-2.1+squeeze10"}]}],"versions":["7.21.0-1","7.21.0-2","7.21.0-2.1+squeeze1","7.21.0-2.1+squeeze2","7.21.0-2.1+squeeze3","7.21.0-2.1+squeeze4","7.21.0-2.1+squeeze5","7.21.0-2.1+squeeze6","7.21.0-2.1+squeeze7","7.21.0-2.1+squeeze8","7.21.0-2.1+squeeze9"]},{"source":"osv","ecosystem":"Debian:7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.26.0-1+wheezy11"}]}],"versions":["7.26.0-1+wheezy10","7.26.0-1+wheezy2","7.26.0-1+wheezy3","7.26.0-1+wheezy4","7.26.0-1+wheezy5","7.26.0-1+wheezy6","7.26.0-1+wheezy7","7.26.0-1+wheezy8","7.26.0-1+wheezy9"]},{"source":"osv","ecosystem":"Mageia:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.28.1-6.6.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.34.0-1.4.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.2"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.2"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1"]}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"haxx","product":"libcurl"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"oracle","product":"hyperion"}],"references":[{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-3069","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2399-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1254.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/70988","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10743","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-02/msg00040.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.apple.com/kb/HT205031","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://curl.haxx.se/docs/adv_20141105.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3707","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x89w-3fj3-7gmx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3707","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0444.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14468","tags":["report"]},{"url":"https://www.debian.org/security/2014/dsa-3069","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1254","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=835898","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=883002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=997185","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1008178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1011083","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1011101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1058767","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1104160","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1136154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154059","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154747","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1156422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1168137","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1178692","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213351","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1254.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3613","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3613","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3613","tags":["advisory"]},{"url":"http://curl.haxx.se/docs/adv_20140910A.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3707","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3707","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8150","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8150","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8150","tags":["advisory"]},{"url":"http://curl.haxx.se/docs/adv_20150108B.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3143","tags":["advisory"]},{"url":"http://curl.haxx.se/docs/adv_20150422A.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3148","tags":["advisory"]},{"url":"http://curl.haxx.se/docs/adv_20150422B.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2015:2159","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1130239","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154060","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161182","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1166264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1218272","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2159.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-3707","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2399-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-3707","description":"The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.","status":"published","published":"2014-11-15T20:00:00Z","modified":"2024-08-06T10:50:17.972Z","updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2014-3653","description":"The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.","status":"published","published":"2014-11-15T20:00:00Z","modified":"2024-08-06T10:50:17Z","updated_at":"2026-11-03T01:57:09.905604Z"}],"ghsa":[{"id":"GHSA-x89w-3fj3-7gmx","title":"The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the...","description":"The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.","status":"published","published":"2022-05-14T02:05:29Z","modified":"2023-02-02T05:05:22Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:52:06.092141Z"}],"nvd":[{"id":"CVE-2014-3707","description":"The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.","status":"published","published":"2014-11-15T20:59:00.14Z","modified":"2026-06-17T00:08:47.477Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"CURL-CVE-2014-3707","title":"duphandle read out of bounds","description":"libcurl's function\n[`curl_easy_duphandle()`](https://curl.se/libcurl/c/curl_easy_duphandle.html)\nhas a bug that can lead to libcurl eventually sending off sensitive data that\nwas not intended for sending.\n\nWhen doing an HTTP POST transfer with libcurl, you can use the\n`CURLOPT_COPYPOSTFIELDS` option to specify a memory area holding the data to\nsend to the remote server. The memory area's size is set with a separate\noption, for example `CURLOPT_POSTFIELDSIZE`.\n\nAs the name implies, the data in the specified buffer is copied to a privately\nheld memory buffer that libcurl allocates on the heap. The memory area is\nassociated with the common CURL handle, often referred to as an \"easy handle\".\n\nThis handle can be duplicated by an application to create an identical copy,\nand all the already set options and data is then also similarly cloned and are\nbe associated with the newly returned handle. This also includes the data to\nsend in an HTTP POST request.\n\nThe internal libcurl function that duplicates options from the old handle to\nthe new had two problems:\n\n1. It mistakenly treated the post data buffer as if it was a C string which is\n   assumed to end with a zero byte. `strdup()` was subsequently used to\n   duplicate the post data buffer, and as a post data buffer can both\n   legitimately contain a zero byte, or may not contain any zero bytes at all\n   (including a tailing one), `strdup()` could create a copy that a) was too\n   small b) was too large or c) could crash due to reading an inaccessible\n   memory area. The `strdup()` function of course allocates memory off the\n   heap.\n\n2. After duplication of the handle data, the pointer used to read from when\n   sending the data was not updated. When sending off the post, libcurl would\n   still read from the original handle's buffer which at that time could have\n   been freed or reused for other purposes.\n\nWhen libcurl subsequently constructs the HTTP POST request and includes data\nfor the protocol body it copies data from that pointer using the old size and\nthe old pointer. This makes a read from the wrong place and can lead to\nlibcurl inserting data into the request that happens to be stored at that\nplaces in memory at that time.\n\nWe are not aware of anyone having been able to actually exploit this for\nnefarious purposes, but we cannot exclude that it is possible or even might\nalready have been exploited.","status":"published","published":"2014-11-05T08:00:00Z","modified":"2026-10-26T13:07:54.518132451Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CVE-2014-3707","description":"The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.","status":"published","published":"2014-11-15T20:59:00Z","modified":"2026-04-16T06:26:02.240115122Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3707","description":"The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.","status":"published","published":"2014-11-15T20:59:00.14Z","modified":"2026-10-23T15:47:34.764550406Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DLA-84-1","title":"curl - security update","status":"published","published":"2014-11-09T00:00:00Z","modified":"2026-03-09T02:08:30.009946Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3069-1","title":"curl - security update","status":"published","published":"2014-11-07T00:00:00Z","modified":"2026-03-09T01:20:22.728515Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0444","title":"Updated curl packages fix CVE-2014-3707","description":"Updated curl packages fix security vulnerability:\n\nSymeon Paraschoudis discovered that the curl_easy_duphandle() function in\ncURL has a bug that can lead to libcurl eventually sending off sensitive data\nthat was not intended for sending, while performing a HTTP POST operation.\nThis bug requires CURLOPT_COPYPOSTFIELDS and curl_easy_duphandle() to be used\nin that order, and then the duplicate handle must be used to perform the HTTP\nPOST. The curl command line tool is not affected by this problem as it does\nnot use this sequence (CVE-2014-3707).\n","status":"published","published":"2014-11-14T00:57:44Z","modified":"2026-04-16T06:23:07.656386342Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"RHSA-2015:1254","title":"Red Hat Security Advisory: curl security, bug fix, and enhancement update","status":"published","published":"2024-09-15T22:15:39Z","modified":"2026-06-28T10:14:15Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:2159","title":"Red Hat Security Advisory: curl security, bug fix, and enhancement update","status":"published","published":"2024-09-15T22:15:45Z","modified":"2026-06-28T10:15:11Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"UBUNTU-CVE-2014-3707","description":"The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.","status":"published","published":"2014-11-05T00:00:00Z","modified":"2026-04-22T09:42:52.582001Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2399-1","title":"curl vulnerability","description":"Symeon Paraschoudis discovered that curl incorrectly handled memory when\nbeing used with CURLOPT_COPYPOSTFIELDS and curl_easy_duphandle(). This may\nresult in sensitive data being incorrectly sent to the remote server.\n","status":"published","published":"2014-11-10T13:43:58Z","modified":"2026-04-22T09:04:20.753634Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}