CVE-2014-3707: apple mac_os_x
CVSS: 4.3v2.0MediumModified
AliasesMGASA-2014-0444UBUNTU-CVE-2014-3707USN-2399-1DEBIAN-CVE-2014-3707DLA-84-1DSA-3069-1
Published 15-11-2014Last modified 06-08-2024
Vulnerability summary
CVE-2014-3707 is a medium (CVSS 4.3) vulnerability in apple mac_os_x. EPSS estimates a 5.12% chance of exploitation in the next 30 days, higher than 92.2% of scored vulnerabilities.
CVSS score
4.3/10
010
Medium · v2.0 (NVD)EPSS score
5.12%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 15-11-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.
CVSS metrics
1 score · 1 source · 1 versionMedium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
5.12%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 5.12% on 19-09-2026
19-09-202619-10-2026
EPSS score5.12%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- curl< 7.38.0-3 | < 7.21.0-2.1+squeeze10 | < 7.26.0-1+wheezy11
- debian_linuxEOL7.0 | 8.0
Mageia2 products
- curl< 7.28.1-6.6.mga3
- curl< 7.34.0-1.4.mga4
Apple1 product
- mac_os_x10.10.0 | 10.10.1 | 10.10.2 | 10.10.3 | 10.10.4
Canonical1 product
- ubuntu_linuxEOL10.04 | 12.04 | 14.04 | 14.10
Haxx1 product
- libcurl7.17.1 | 7.18.0 | 7.18.1 | 7.18.2 | 7.19.0 | 7.19.1 | 7.19.2 | 7.19.3 | 7.19.4 | 7.19.5 | 7.19.6 | 7.19.7 | 7.20.0 | 7.20.1 | 7.21.0 | 7.21.1 | 7.21.2 | 7.21.3 | 7.21.4 | 7.21.5 | 7.21.6 | 7.21.7 | 7.22.0 | 7.23.0 | 7.23.1 | 7.24.0 | 7.25.0 | 7.26.0 | 7.27.0 | 7.28.0 | 7.28.1 | 7.29.0 | 7.30.0 | 7.31.0 | 7.32.0 | 7.33.0 | 7.34.0 | 7.35.0 | 7.36.0 | 7.37.0 | 7.37.1 | 7.38.0
Opensuse1 product
- opensuseEOL13.1 | 13.2
Oracle1 product
- hyperion11.1.2.2 | 11.1.2.3
Ubuntu1 product
- curl< 7.35.0-1ubuntu2.2
8 vendors · 10 products
References
20 links- www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlX Refsource CONFIRMVendor Advisory
- www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlX Refsource CONFIRMVendor Advisory
- www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlX Refsource CONFIRM
- www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlX Refsource CONFIRM
- lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
- kb.juniper.net/InfoCenter/index?page=content&id=JSA10743X Refsource CONFIRM
Show all 20 references
- lists.opensuse.org/opensuse-updates/2015-02/msg00040.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory