NetSight
IP …
medium4.3

CVE-2014-3707

The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data f…

Impact

The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.

Affected products

VendorProductAffected versions
CanonicalUbuntu Linux
Versions 10.04, 12.04, 14.04, 14.10
AppleMac Os X
Versions 10.10.0, 10.10.1, 10.10.2, 10.10.3, 10.10.4
OpensuseOpensuse
Versions 13.1, 13.2
OracleHyperion
Versions 11.1.2.2, 11.1.2.3
DebianDebian Linux
Versions 7.0, 8.0
HaxxLibcurl
Versions 7.17.1, 7.18.0, 7.18.1, 7.18.2, 7.19.0, 7.19.1

Weakness classification

CWE-200

References