CVE-2013-1944

Name	CVE-2013-1944
Description	The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DSA-2660-1
Debian Bugs	705274

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
curl (PTS)	buster	7.64.0-4+deb10u2	fixed
	buster (security)	7.64.0-4+deb10u5	fixed
	bullseye	7.74.0-1.3+deb11u3	fixed
	bullseye (security)	7.74.0-1.3+deb11u7	fixed
	bookworm	7.88.1-6	fixed
	sid	7.88.1-7	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
curl	source	squeeze	7.21.0-2.1+squeeze3	DSA-2660-1
curl	source	wheezy	7.26.0-1+wheezy2
curl	source	(unstable)	7.29.0-2.1		705274

http://curl.haxx.se/docs/adv_20130412.html