CVE-2014-3620: Apple Mac OS X

Medium severity, CVSS 5.0. EPSS: 4.2% chance of exploitation in the next 30 days.

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.

Affected products

• Apple Mac OS X: up to and including 10.10.4
• Haxx Curl: up to and including 7.37.1; version 7.31.0 only; version 7.32.0 only; version 7.33.0 only; version 7.34.0 only; version 7.35.0 only; …
• Haxx Libcurl: up to and including 7.37.1; version 7.31.0 only; version 7.32.0 only; version 7.33.0 only; version 7.34.0 only; version 7.35.0 only; …

Published 2014-11-18. Last modified 2026-06-17.