Debian Security Advisory

DLA-64-1 curl -- LTS security update

Date Reported:
26 Sep 2014
Affected Packages:
Security database references:
In Mitre's CVE dictionary: CVE-2014-3613.
More information:


By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP cookies, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others.

For Debian 6 Squeeze, these issues have been fixed in curl version 7.21.0-2.1+squeeze9