{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-11-05T00:00:00", "descriptions": [{"lang": "en", "value": "The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-04T19:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"}, {"name": "DSA-3069", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2014/dsa-3069"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html"}, {"name": "USN-2399-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-2399-1"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"}, {"name": "APPLE-SA-2015-08-13-2", "tags": ["vendor-advisory", "x_refsource_APPLE"], "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"}, {"name": "RHSA-2015:1254", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1254.html"}, {"name": "70988", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/70988"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743"}, {"name": "openSUSE-SU-2015:0248", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00040.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://support.apple.com/kb/HT205031"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://curl.haxx.se/docs/adv_20141105.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2014-3707", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"}, {"name": "DSA-3069", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2014/dsa-3069"}, {"name": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html"}, {"name": "USN-2399-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2399-1"}, {"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"}, {"name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"}, {"name": "APPLE-SA-2015-08-13-2", "refsource": "APPLE", "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"}, {"name": "RHSA-2015:1254", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-1254.html"}, {"name": "70988", "refsource": "BID", "url": "http://www.securityfocus.com/bid/70988"}, {"name": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743", "refsource": "CONFIRM", "url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743"}, {"name": "openSUSE-SU-2015:0248", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00040.html"}, {"name": "https://support.apple.com/kb/HT205031", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT205031"}, {"name": "http://curl.haxx.se/docs/adv_20141105.html", "refsource": "CONFIRM", "url": "http://curl.haxx.se/docs/adv_20141105.html"}]}}}}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2014-3707", "datePublished": "2014-11-15T20:00:00", "dateReserved": "2014-05-14T00:00:00", "dateUpdated": "2018-01-04T19:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*", "matchCriteriaId": "5D37DF0F-F863-45AC-853A-3E04F9FEC7CA", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*", "matchCriteriaId": "49A63F39-30BE-443F-AF10-6245587D3359", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:mac_os_x:10.10.0:*:*:*:*:*:*:*", "matchCriteriaId": "C8A2286E-9D1C-4B56-8B40-150201B818AF", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:mac_os_x:10.10.1:*:*:*:*:*:*:*", "matchCriteriaId": "0AF9BC68-7F0D-4DF9-9CD8-6CE9844555C0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:mac_os_x:10.10.2:*:*:*:*:*:*:*", "matchCriteriaId": "D35FAC77-A0DD-4AF9-AA9E-A4B170842D2D", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:mac_os_x:10.10.3:*:*:*:*:*:*:*", "matchCriteriaId": "831B1114-7CA7-43E3-9A15-592218060A1F", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:mac_os_x:10.10.4:*:*:*:*:*:*:*", "matchCriteriaId": "E8B0A12E-E122-4189-A05E-4FEA43C19876", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*", "matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F", "vulnerable": true}, {"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*", "matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:hyperion:11.1.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "74DA49AC-B255-470A-839D-210EA929AB96", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:hyperion:11.1.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "9D31D1BC-B017-4464-A0E3-84C2F20887C3", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:haxx:libcurl:7.17.1:*:*:*:*:*:*:*", "matchCriteriaId": "08C8EE1E-E186-42D6-8B12-05865C73F261", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.18.0:*:*:*:*:*:*:*", "matchCriteriaId": "EEA3D88B-41B9-4D79-B47D-B3D6058C0C27", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.18.1:*:*:*:*:*:*:*", "matchCriteriaId": "C2C80901-D48E-4C2A-9BED-A40007A11C97", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.18.2:*:*:*:*:*:*:*", "matchCriteriaId": "331A51E4-AA73-486F-9618-5A83965F2436", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.19.0:*:*:*:*:*:*:*", "matchCriteriaId": "EB32DF2C-9208-4853-ADEB-B00D764D7467", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.19.1:*:*:*:*:*:*:*", "matchCriteriaId": "E05636DC-7E38-4605-AAB8-81C0AE37520A", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.19.2:*:*:*:*:*:*:*", "matchCriteriaId": "624DF2F1-53FD-48D3-B93D-44E99C9C0C5D", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.19.3:*:*:*:*:*:*:*", "matchCriteriaId": "F2171C7C-311A-4405-B95F-3A54966FA844", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.19.4:*:*:*:*:*:*:*", "matchCriteriaId": "5DE20A41-8B53-46FC-9002-69CC7495171F", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.19.5:*:*:*:*:*:*:*", "matchCriteriaId": "87ED9DA0-E880-4CBB-B1AC-5AEE8A004718", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.19.6:*:*:*:*:*:*:*", "matchCriteriaId": "5293C7F0-BF9F-4768-889A-876CE78903CC", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.19.7:*:*:*:*:*:*:*", "matchCriteriaId": "F3EB41B3-65F3-4B0E-8CCC-325B14AF605B", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.20.0:*:*:*:*:*:*:*", "matchCriteriaId": "857B244C-2AFB-40C7-A893-7C6DE9871BCE", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.20.1:*:*:*:*:*:*:*", "matchCriteriaId": "B732CE55-820A-40E0-A885-71BBB6CF8C15", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.21.0:*:*:*:*:*:*:*", "matchCriteriaId": "0455A5F2-1515-4CD8-BA2F-74D28E91A661", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.21.1:*:*:*:*:*:*:*", "matchCriteriaId": "29034B3A-BE9D-4D68-8C56-4465C03C3693", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.21.2:*:*:*:*:*:*:*", "matchCriteriaId": "6249538E-FBCB-4130-91FB-DA78D7BA45DE", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.21.3:*:*:*:*:*:*:*", "matchCriteriaId": "5E11B8A5-50A2-468F-BFB3-86DD9D28AC73", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.21.4:*:*:*:*:*:*:*", "matchCriteriaId": "9EAE25A0-3828-46F1-AB30-88732CBC9F38", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.21.5:*:*:*:*:*:*:*", "matchCriteriaId": "1533A85C-2160-445D-8787-E624AEDC5A0C", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.21.6:*:*:*:*:*:*:*", "matchCriteriaId": "D87B9393-7EA4-43DA-900C-7E840AE2D4C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.21.7:*:*:*:*:*:*:*", "matchCriteriaId": "7D1249E9-304F-4952-8DAB-8B79CE5E7D54", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.22.0:*:*:*:*:*:*:*", "matchCriteriaId": "83FAF953-6A65-4FAB-BDB5-03B468CD1C9A", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.23.0:*:*:*:*:*:*:*", "matchCriteriaId": "29F8FF1F-A639-4161-9366-62528AAF4C07", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.23.1:*:*:*:*:*:*:*", "matchCriteriaId": "812AB429-379A-4EDE-9664-5BC2989053F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.24.0:*:*:*:*:*:*:*", "matchCriteriaId": "13DD791F-C4BD-4456-955A-92E84082AA09", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.25.0:*:*:*:*:*:*:*", "matchCriteriaId": "4A17E442-45AA-4780-98B4-9BF764DCC1C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.26.0:*:*:*:*:*:*:*", "matchCriteriaId": "F6AF544C-5F16-4434-B9FB-93B1B7318950", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.27.0:*:*:*:*:*:*:*", "matchCriteriaId": "CBFD9ED9-2412-44AE-9C55-0ED03A121B23", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.28.0:*:*:*:*:*:*:*", "matchCriteriaId": "67CCE31B-ABDA-4F32-BAF1-B1AD0664B3E2", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.28.1:*:*:*:*:*:*:*", "matchCriteriaId": "9E66A332-ECD1-4452-B444-FB629022FDF0", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.29.0:*:*:*:*:*:*:*", "matchCriteriaId": "CDD3D599-35E9-4590-B5E0-3AF04D344695", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.30.0:*:*:*:*:*:*:*", "matchCriteriaId": "A3B6BFFB-7967-482C-9B49-4BD25C815299", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.31.0:*:*:*:*:*:*:*", "matchCriteriaId": "1791BF6D-2C96-4A6E-90D4-2906A73601F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.32.0:*:*:*:*:*:*:*", "matchCriteriaId": "260DD751-4145-4B75-B892-5FC932C6A305", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.33.0:*:*:*:*:*:*:*", "matchCriteriaId": "EFF4AD0D-2EC5-4CE8-B6B3-2EC8ED2FF118", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.34.0:*:*:*:*:*:*:*", "matchCriteriaId": "3EB1CB85-0A9B-4816-B471-278774EE6D4C", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.35.0:*:*:*:*:*:*:*", "matchCriteriaId": "3831AB03-4E7E-476D-9623-58AADC188DFE", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.36.0:*:*:*:*:*:*:*", "matchCriteriaId": "ABACE305-2F0C-4B59-BC5C-6DF162B450E4", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.37.0:*:*:*:*:*:*:*", "matchCriteriaId": "6FAC1B55-F492-484E-B837-E7745682DE0A", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.37.1:*:*:*:*:*:*:*", "matchCriteriaId": "E0D57914-B40A-462B-9C78-6433BE2B2DB4", "vulnerable": true}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.38.0:*:*:*:*:*:*:*", "matchCriteriaId": "A9A12DF7-62C5-46AD-9236-E2821C64156E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information."}, {"lang": "es", "value": "La funci\u00f3n curl_easy_duphandle en libcurl 7.17.1 hasta 7.38.0, cuando se ejecuta con la opci\u00f3n CURLOPT_COPYPOSTFIELDS, no copia debidamente datos HTTP POST para un manejo sencillo, lo que provoca una lectura fuera de rango que permite a servidores web remotos leer informaci\u00f3n sensible de la memoria."}], "id": "CVE-2014-3707", "lastModified": "2018-10-30T16:27:35.843", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-11-15T20:59:00.140", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://curl.haxx.se/docs/adv_20141105.html"}, {"source": "secalert@redhat.com", "url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743"}, {"source": "secalert@redhat.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00040.html"}, {"source": "secalert@redhat.com", "url": "http://rhn.redhat.com/errata/RHSA-2015-1254.html"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "http://www.debian.org/security/2014/dsa-3069"}, {"source": "secalert@redhat.com", "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html"}, {"source": "secalert@redhat.com", "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/70988"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "http://www.ubuntu.com/usn/USN-2399-1"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://support.apple.com/kb/HT205031"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}