CVE-2014-3707: Apple Mac OS X

Medium severity, CVSS 4.3. EPSS: 5.1% chance of exploitation in the next 30 days.

The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.

Affected products

• Apple Mac OS X: version 10.10.0 only; version 10.10.1 only; version 10.10.2 only; version 10.10.3 only; version 10.10.4 only
• Canonical Ubuntu Linux: version 10.04 only; version 12.04 only; version 14.04 only; version 14.10 only
• Debian Debian Linux: version 7.0 only; version 8.0 only
• Haxx Libcurl: version 7.17.1 only; version 7.18.0 only; version 7.18.1 only; version 7.18.2 only; version 7.19.0 only; version 7.19.1 only; …
• Opensuse Opensuse: version 13.1 only; version 13.2 only
• Oracle Hyperion: version 11.1.2.2 only; version 11.1.2.3 only

Published 2014-11-15. Last modified 2026-06-17.