Debian Security Advisory
DLA-64-1 curl -- LTS security update
- Date Reported:
- 26 Sep 2014
- Affected Packages:
- curl
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2014-3613.
- More information:
-
By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP cookies, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others.
For Debian 6
Squeeze
, these issues have been fixed in curl version 7.21.0-2.1+squeeze9