CVE-2014-3613: Apple Mac OS X

Medium severity, CVSS 5.0. EPSS: 7.1% chance of exploitation in the next 30 days.

cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.

Affected products

• Apple Mac OS X: up to and including 10.10.4
• Haxx Curl: up to and including 7.37.1; version 7.31.0 only; version 7.32.0 only; version 7.33.0 only; version 7.34.0 only; version 7.35.0 only; …
• Haxx Libcurl: up to and including 7.37.1; version 7.31.0 only; version 7.32.0 only; version 7.33.0 only; version 7.34.0 only; version 7.35.0 only; …

Published 2014-11-18. Last modified 2026-06-17.