CVE-2014-3707

The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.

• CWE-200

• http://curl.haxx.se/docs/adv_20141105.htmlVendor Advisory
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
• http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2015-02/msg00040.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1254.html
• http://www.debian.org/security/2014/dsa-3069Third Party Advisory
• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
• http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
• http://www.securityfocus.com/bid/70988
• http://www.ubuntu.com/usn/USN-2399-1Third Party Advisory
• https://support.apple.com/kb/HT205031Third Party Advisory
• http://curl.haxx.se/docs/adv_20141105.htmlVendor Advisory
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
• http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2015-02/msg00040.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1254.html
• http://www.debian.org/security/2014/dsa-3069Third Party Advisory
• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
• http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
• http://www.securityfocus.com/bid/70988
• http://www.ubuntu.com/usn/USN-2399-1Third Party Advisory
• https://support.apple.com/kb/HT205031Third Party Advisory

Published

Nov 15, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3701eDeploy has tmp file race condition flaws8.1
• CVE-2014-3702Directory traversal vulnerability in eNovance eDeploy allows…
• CVE-2014-3703OpenStack PackStack 2012.2.1, when the Open vSwitch (OVS) mo…
• CVE-2014-3704The expandArguments function in the database abstraction API…
• CVE-2014-3705Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-3706ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-mi…
• CVE-2014-3708OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before…
• CVE-2014-3709The org.keycloak.services.resources.SocialResource.callback …
• CVE-2014-3710The donote function in readelf.c in file through 5.20, as us…
• CVE-2014-3711namei in FreeBSD 9.1 through 10.1-RC2 allows remote attacker…
• CVE-2014-3712Katello allows remote attackers to cause a denial of service…
• CVE-2014-3714The ARM image loading functionality in Xen 4.4.x does not pr…