Upstream information

CVE-2014-3620 at MITRE

Description

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 5
Vector AV:N/AC:L/Au:N/C:N/I:P/A:N
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact Partial
Availability Impact None
SUSE Bugzilla entries: 894575 [RESOLVED], 895991 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise Desktop 12
  • curl >= 7.37.0-2.5
  • libcurl4 >= 7.37.0-2.5
  • libcurl4-32bit >= 7.37.0-2.5
Patchnames:
SUSE Linux Enterprise Desktop 12 GA curl
SUSE Linux Enterprise Desktop 12 SP1
  • curl >= 7.37.0-15.1
  • libcurl4 >= 7.37.0-15.1
  • libcurl4-32bit >= 7.37.0-15.1
Patchnames:
SUSE Linux Enterprise Desktop 12 SP1 GA curl
SUSE Linux Enterprise Desktop 12 SP2
  • curl >= 7.37.0-28.1
  • libcurl4 >= 7.37.0-28.1
  • libcurl4-32bit >= 7.37.0-28.1
Patchnames:
SUSE Linux Enterprise Desktop 12 SP2 GA curl
SUSE Linux Enterprise Desktop 12 SP3
  • curl >= 7.37.0-36.1
  • libcurl4 >= 7.37.0-36.1
  • libcurl4-32bit >= 7.37.0-36.1
Patchnames:
SUSE Linux Enterprise Desktop 12 SP3 GA curl
SUSE Linux Enterprise Module for Basesystem 15
  • curl >= 7.60.0-1.1
  • libcurl-devel >= 7.60.0-1.1
  • libcurl4 >= 7.60.0-1.1
  • libcurl4-32bit >= 7.60.0-1.1
Patchnames:
SUSE Linux Enterprise Module for Basesystem 15 GA curl
SUSE Linux Enterprise Server 12
  • curl >= 7.37.0-2.5
  • libcurl4 >= 7.37.0-2.5
  • libcurl4-32bit >= 7.37.0-2.5
Patchnames:
SUSE Linux Enterprise Server 12 GA curl
SUSE Linux Enterprise Server 12 SP1
  • curl >= 7.37.0-15.1
  • libcurl4 >= 7.37.0-15.1
  • libcurl4-32bit >= 7.37.0-15.1
Patchnames:
SUSE Linux Enterprise Server 12 SP1 GA curl
SUSE Linux Enterprise Server 12 SP2
  • curl >= 7.37.0-28.1
  • libcurl4 >= 7.37.0-28.1
  • libcurl4-32bit >= 7.37.0-28.1
Patchnames:
SUSE Linux Enterprise Server 12 SP2 GA curl
SUSE Linux Enterprise Server 12 SP3
  • curl >= 7.37.0-36.1
  • libcurl4 >= 7.37.0-36.1
  • libcurl4-32bit >= 7.37.0-36.1
Patchnames:
SUSE Linux Enterprise Server 12 SP3 GA curl
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2
  • curl >= 7.37.0-28.1
  • libcurl4 >= 7.37.0-28.1
Patchnames:
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 GA curl
SUSE Linux Enterprise Software Development Kit 12
  • libcurl-devel >= 7.37.0-2.5
Patchnames:
SUSE Linux Enterprise Software Development Kit 12 GA libcurl-devel
SUSE Linux Enterprise Software Development Kit 12 SP1
  • libcurl-devel >= 7.37.0-15.1
Patchnames:
SUSE Linux Enterprise Software Development Kit 12 SP1 GA libcurl-devel
SUSE Linux Enterprise Software Development Kit 12 SP2
  • libcurl-devel >= 7.37.0-28.1
Patchnames:
SUSE Linux Enterprise Software Development Kit 12 SP2 GA libcurl-devel
SUSE Linux Enterprise Software Development Kit 12 SP3
  • libcurl-devel >= 7.37.0-36.1
Patchnames:
SUSE Linux Enterprise Software Development Kit 12 SP3 GA libcurl-devel
openSUSE 13.1
  • curl >= 7.32.0-2.27.1
  • curl-debuginfo >= 7.32.0-2.27.1
  • curl-debugsource >= 7.32.0-2.27.1
  • libcurl-devel >= 7.32.0-2.27.1
  • libcurl4 >= 7.32.0-2.27.1
  • libcurl4-32bit >= 7.32.0-2.27.1
  • libcurl4-debuginfo >= 7.32.0-2.27.1
  • libcurl4-debuginfo-32bit >= 7.32.0-2.27.1
Patchnames:
openSUSE-2014-547
openSUSE Leap 15.0
  • curl >= 7.59.0-lp150.1.1
  • libcurl4 >= 7.59.0-lp150.1.1
  • libcurl4-32bit >= 7.59.0-lp150.1.1
Patchnames:
openSUSE Leap 15.0 GA curl
openSUSE Leap 42.1
  • curl >= 7.37.0-5.2
  • libcurl-devel >= 7.37.0-5.2
  • libcurl4 >= 7.37.0-5.2
Patchnames:
openSUSE Leap 42.1 GA curl
openSUSE Leap 42.2
  • curl >= 7.37.0-15.1
  • libcurl-devel >= 7.37.0-15.1
  • libcurl4 >= 7.37.0-15.1
Patchnames:
openSUSE Leap 42.2 GA curl
openSUSE Leap 42.3
  • curl >= 7.37.0-18.5
  • libcurl-devel >= 7.37.0-18.5
  • libcurl4 >= 7.37.0-18.5
Patchnames:
openSUSE Leap 42.3 GA curl
openSUSE Tumbleweed
  • curl >= 7.51.0-1.1
  • libcurl-devel >= 7.51.0-1.1
  • libcurl-devel-32bit >= 7.51.0-1.1
  • libcurl4 >= 7.51.0-1.1
  • libcurl4-32bit >= 7.51.0-1.1
Patchnames:
openSUSE Tumbleweed GA curl