CVE-2013-1944

Name	CVE-2013-1944
Description	The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-2660-1
Debian Bugs	705274

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
curl (PTS)	bullseye	7.74.0-1.3+deb11u13	fixed
	bullseye (security)	7.74.0-1.3+deb11u15	fixed
	bookworm	7.88.1-10+deb12u14	fixed
	bookworm (security)	7.88.1-10+deb12u5	fixed
	trixie	8.14.1-2	fixed
	forky	8.17.0~rc2-1	fixed
	sid	8.17.0~rc3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
curl	source	squeeze	7.21.0-2.1+squeeze3	DSA-2660-1
curl	source	wheezy	7.26.0-1+wheezy2
curl	source	(unstable)	7.29.0-2.1		705274

http://curl.haxx.se/docs/adv_20130412.html