NetSight
IP …
critical9.1

CVE-2018-1000301

curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tr…

Impact

curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.

Affected products

VendorProductAffected versions
DebianDebian Linux
Versions 7.0, 8.0, 9.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 17.10, 18.04
HaxxCurl
from 7.20.0 through 7.59.0
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Workstation
Version 7.0
OracleCommunications Webrtc Session Controller
before 7.2
OracleEnterprise Manager Ops Center
Versions 12.2.2, 12.3.3
OraclePeoplesoft Enterprise Peopletools
Versions 8.55, 8.56, 8.57

Weakness classification

CWE-125

References